CVE-2024-0866 Check & Log Email <= 1.0.9 - Unauthenticated Hook Injection
Unauthenticated attackers can inject hooks to execute arbitrary actions in the Check & Log Email WordPress plugin if nonces are known and capability checks are missing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0866?
CVE-2024-0866 is a high-severity code injection vulnerability in checkemail Check & Log Email – Easy Email Testing & Mail logging, published on 26 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Check & Log Email plugin for WordPress is vulnerable to Unauthenticated Hook Injection in all versions up to, and including, 1.0.9 via the check_nonce function. This makes it possible for unauthenticated attackers to execute actions with hooks in WordPress under certain circumstances. The action the attacker wishes to execute needs to have a nonce check, and the nonce needs to be known to the attacker. Furthermore, the absence of a capability check is a requirement.
Weakness: CWE-94
Which versions are affected by CVE-2024-0866?
How do I fix CVE-2024-0866?
No fix has been published for CVE-2024-0866 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-0866 being exploited?
There is no known exploitation of CVE-2024-0866 in the wild and no public exploit code.
Sources
Also known as GHSA-85hw-p3wr-87q9.