CVE-2024-0866
Assigner: Wordfence
Published: 2024-03-26T03:08:07.854Z
State: PUBLISHED
affected: vendor: checkemail
product: Check & Log Email
versions: version: *
status: affected
lessThanOrEqual: 1.0.9
versionType: semver
defaultStatus: unaffected
descriptions: value: The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
problemTypes: descriptions: description: CWE-94 Improper Control of Generation of Code ('Code Injection')
metrics: cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.1
baseSeverity: HIGH
credits: type: finder
value: Sean Murphy
timeline: time: 2024-03-25T00:00:00.000+00:00
value: Disclosed