CVE-2020-35234 Information disclosure in n/a
An attacker can gain Administrator access by reading debug logs containing password reset links in the Easy WP SMTP plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35234?
CVE-2020-35234 is a high-severity vulnerability in n/a, published on 14 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.
Weakness: CWE-532
Which versions are affected by CVE-2020-35234?
It affects 1 product.
Products include Wp-Ecommerce Easy Wp Smtp.
How do I fix CVE-2020-35234?
No fix has been published for CVE-2020-35234 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-35234 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35234 exists.
Public exploit code: 1 Metasploit module and 1 Nuclei template.
Other vulnerabilities in n/a
- CVE-2019-25141 Easy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
- CVE-2022-42699 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
- CVE-2022-45829 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Arbitrary File Deletion
- CVE-2022-3334 Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection
- CVE-2022-45833 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Directory Traversal
Sources
Also known as GHSA-m9j8-w3jp-p7wq.