CVE-2023-3178 POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRF
Attackers can trick authenticated users into deleting arbitrary logs via CSRF in the POST SMTP Mailer WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-3178?
CVE-2023-3178 is a medium-severity vulnerability in Unknown POST SMTP Mailer, published on 16 Jan 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The POST SMTP Mailer WordPress plugin before 2.5.7 does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability delete arbitrary logs via a CSRF attack.
Weakness: CWE-352
Which versions are affected by CVE-2023-3178?
It affects 1 product.
Products include Wpexperts Post Smtp.
How do I fix CVE-2023-3178?
No fix has been published for CVE-2023-3178 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-3178 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3178 exists.
Other vulnerabilities in Unknown POST SMTP Mailer
- CVE-2023-6875 Auth bypass in Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App
- CVE-2023-3179 POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF
- CVE-2023-52233 WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability
- CVE-2024-52436 WordPress Post SMTP plugin <= 2.9.9 - SQL Injection vulnerability
- CVE-2025-0521 Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
Sources
Also known as GHSA-vv37-8w95-rgj3.