Vulnerabilities > CVE-2019-25141 - Missing Authorization vulnerability in Wp-Ecommerce Easy WP Smtp

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

wp-ecommerce

CWE-862

critical

NVD

Published: 2023-06-07

Updated: 2024-11-21

Summary

The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This makes it possible for unauthenticated attackers to modify the plugins settings and arbitrary options on the site that can be used to inject new administrative user accounts.

Vulnerable Configurations

Part	Description	Count
Application	Wp-Ecommerce WP Ecommerce Easy WP Smtp - WP Ecommerce Easy WP Smtp 1.0.1 WP Ecommerce Easy WP Smtp 1.0.2 WP Ecommerce Easy WP Smtp 1.0.3 WP Ecommerce Easy WP Smtp 1.0.4 WP Ecommerce Easy WP Smtp 1.0.5 WP Ecommerce Easy WP Smtp 1.0.6 WP Ecommerce Easy WP Smtp 1.0.7 WP Ecommerce Easy WP Smtp 1.0.8 WP Ecommerce Easy WP Smtp 1.0.9 WP Ecommerce Easy WP Smtp 1.1.0 WP Ecommerce Easy WP Smtp 1.1.1 WP Ecommerce Easy WP Smtp 1.1.2 WP Ecommerce Easy WP Smtp 1.1.3 WP Ecommerce Easy WP Smtp 1.1.4 WP Ecommerce Easy WP Smtp 1.1.5 WP Ecommerce Easy WP Smtp 1.1.6 WP Ecommerce Easy WP Smtp 1.1.7 WP Ecommerce Easy WP Smtp 1.1.8 WP Ecommerce Easy WP Smtp 1.1.9 WP Ecommerce Easy WP Smtp 1.2.0 WP Ecommerce Easy WP Smtp 1.2.1 WP Ecommerce Easy WP Smtp 1.2.2 WP Ecommerce Easy WP Smtp 1.2.3 WP Ecommerce Easy WP Smtp 1.2.4 WP Ecommerce Easy WP Smtp 1.2.5 WP Ecommerce Easy WP Smtp 1.2.6 WP Ecommerce Easy WP Smtp 1.2.7 WP Ecommerce Easy WP Smtp 1.2.8 WP Ecommerce Easy WP Smtp 1.2.9 WP Ecommerce Easy WP Smtp 1.3.0 WP Ecommerce Easy WP Smtp 1.3.1 WP Ecommerce Easy WP Smtp 1.3.2 WP Ecommerce Easy WP Smtp 1.3.3 WP Ecommerce Easy WP Smtp 1.3.4 WP Ecommerce Easy WP Smtp 1.3.5 WP Ecommerce Easy WP Smtp 1.3.6 WP Ecommerce Easy WP Smtp 1.3.7 WP Ecommerce Easy WP Smtp 1.3.8 WP Ecommerce Easy WP Smtp 1.3.8.1 WP Ecommerce Easy WP Smtp 1.3.9	41

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References