Vulnerability · Published Sep 26, 2022 · Assigned by WPScan
CVE-2022-2352Post SMTP < 2.1.7 - Admin+ Blind SSRF
High 7.2
In plain English
A high-severity server-side request forgery in Post SMTP Mailer/Email Log from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Post SMTP Mailer/Email Log | 2.1.7 – before 2.1.7 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H