CVE-2022-2370 YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

2022-08-0112:52:51

WPScan

www.cve.org

yaysmtp

wordpress

plugin

authenticated users

smtp credentials

EPSS

0.001

Percentile

32.8%

JSON

The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "YaySMTP",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.2.1"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/bedda2a9-6c52-478e-b17a-7a4488419334

EPSS

0.001

Percentile

32.8%

JSON

Related for CVELIST:CVE-2022-2370