CVE-2023-0766 Newsletter Popup <= 1.2 - Record Deletion via CSRF
Attackers can trick logged-in users into deleting newsletter records via CSRF due to missing nonce checks in the Newsletter Popup plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-0766?
CVE-2023-0766 is a high-severity vulnerability in Unknown Newsletter Popup, published on 30 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Newsletter Popup WordPress plugin through 1.2 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks as the wp_newsletter_show_localrecord page is not protected with a nonce.
Which versions are affected by CVE-2023-0766?
It affects 1 product.
Products include Newsletter Popup Project Newsletter Popup.
How do I fix CVE-2023-0766?
No fix has been published for CVE-2023-0766 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-0766 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0766 exists.
Other vulnerabilities in Unknown Newsletter Popup
Sources
Also known as GHSA-fq23-cx8p-693x.