CVE-2023-5314 WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sending

What is CVE-2023-5314?

CVE-2023-5314 is a medium-severity missing authorization vulnerability in wpvncom WP EXtra – One Click Optimize, published on 22 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The WP EXtra plugin for WordPress is vulnerable to unauthorized access to restricted functionality due to a missing capability check on the 'test-email' section of the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to send emails with arbitrary content to arbitrary locations from the affected site's mail server.

Weakness: CWE-862

Which versions are affected by CVE-2023-5314?

It affects 1 product.

Products include Wpvnteam Wp Extra.

How do I fix CVE-2023-5314?

No fix has been published for CVE-2023-5314 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-5314 being exploited?

There is no known exploitation of CVE-2023-5314 in the wild and no public exploit code.

Other vulnerabilities in wpvncom WP EXtra – One Click Optimize

• CVE-2023-46623 WordPress WP EXtra Plugin <= 6.2 is vulnerable to Remote Code Execution (RCE) Critical 9.9
• CVE-2023-5311 WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification High 8.8
• CVE-2023-46212 WordPress WP EXtra Plugin <= 6.2 is vulnerable to Broken Access Control Medium 6.3
• CVE-2023-47825 WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF) Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-h572-9c8v-9vqh.