CVE-2022-1603 Mail Subscribe List < 2.1.4 - Arbitrary Subscribed User Deletion via CSRF
Attackers can trick logged-in admins into deleting arbitrary subscribed users via CSRF in the Mail Subscribe List plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-1603?
CVE-2022-1603 is a medium-severity vulnerability in Unknown Mail Subscribe List, published on 20 Jun 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list
Weakness: CWE-352
Which versions are affected by CVE-2022-1603?
It affects 1 product.
Products include Webfwd Mail Subscribe List.
How do I fix CVE-2022-1603?
No fix has been published for CVE-2022-1603 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1603 being exploited?
There is no known exploitation of CVE-2022-1603 in the wild and no public exploit code.
Other vulnerabilities in Unknown Mail Subscribe List
Sources
Also known as GHSA-wwxw-x9mh-v66p.