CVSS: 2.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-3073 – Easy WP SMTP by SendLayer <= 2.3.0 - Exposure of Sensitive Information via the UI
https://notcve.org/view.php?id=CVE-2024-3073
The Easy WP SMTP by SendLayer – WordPress SMTP and Email Log Plugin plugin for WordPress is vulnerable to information exposure in all versions up to, and including, 2.3.0. This is due to plugin providing the SMTP password in the SMTP Password field when viewing the settings. This makes it possible for authenticated attackers, with administrative-level access and above, to view the SMTP password for the supplied server. Although this would not be useful for attackers in most cases, if an administrator account becomes compromised this could be useful information to an attacker in a limited environment. El complemento Easy WP SMTP de SendLayer – WordPress SMTP y Email Log Plugin para WordPress es vulnerable a la exposición de información en todas las versiones hasta la 2.3.0 incluida. • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3101553%40easy-wp-smtp&new=3101553%40easy-wp-smtp&sfp_email=&sfph_mail= https://www.wordfence.com/threat-intel/vulnerabilities/id/b043197c-4477-4663-abb8-5840173c574d?source=cve • CWE-257: Storing Passwords in a Recoverable Format •
CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2022-42699 – WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
https://notcve.org/view.php?id=CVE-2022-42699
Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. Vulnerabilidad de ejecución remota de código autenticada en el complemento Easy WP SMTP en versiones <= 1.5.1 en WordPress. The Easy WP SMTP plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 1.5.1 possibly via the 'admin_init' function (as part of the SMTP import/export functionality). This allows administrator-level attackers to execute code on the server. • https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-remote-code-execution-rce-vulnerability?_s_id=cve • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45833 – WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
https://notcve.org/view.php?id=CVE-2022-45833
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. Vulnerabilidad de Path Traversal autorizada en el complemento Easy WP SMTP en versiones <= 1.5.1 en WordPress. The Easy WP SMTP plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 1.5.1 possibly via the 'admin_init' function (as part of the SMTP import/export functionality). This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information. • https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-read-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.7EPSS: 0%CPEs: 1EXPL: 0CVE-2022-45829 – WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
https://notcve.org/view.php?id=CVE-2022-45829
Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress. Vulnerabilidad de Path Traversal autenticada en el complemento Easy WP SMTP en versiones <= 1.5.1 en WordPress. The Easy WP SMTP plugin for WordPress is vulnerable to Arbitrary File Deletion versions up to, and including, 1.5.1. This is possibly due to the SMTP import/export functionality. • https://patchstack.com/database/vulnerability/easy-wp-smtp/wordpress-easy-wp-smtp-plugin-1-5-1-auth-arbitrary-file-deletion-vulnerability?_s_id=cve • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3334 – Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection
https://notcve.org/view.php?id=CVE-2022-3334
The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. El complemento Easy WP SMTP de WordPress anterior a 1.5.0 deserializa el contenido de un archivo importado, lo que podría provocar un problema de inyección de objetos PHP cuando un administrador importa (intencionalmente o no) un archivo malicioso y una cadena de gadgets adecuada está presente en el blog. The Easy WP SMTP plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.4.9 via deserialization of untrusted input when processing the contents of an imported file. This allows administrator-level attackers to inject a PHP Object. No POP chain is present in the vulnerable plugin. • https://wpscan.com/vulnerability/0e735502-eaa2-4047-949e-bc8eb6b39fc9 • CWE-502: Deserialization of Untrusted Data •