CVE-2020-35234

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...

CVE-2020-35234

creationtimestamp| type| source ---|---|--- 2020-12-18 22:18:46+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wpeasywpsmtp.rb 2025-02-06 03:13:44+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:28+00:00| seen|...

CVE-2020-35234

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file such as debuglog.txt that contains all password-reset link...

CVE-2020-35234

The CVE refers to the WordPress plugin Easy WP SMTP (versions before 1.4.4). A directory-listing issue in wp-content/plugins/easy-wp-smtp/ exposes a log file (e.g., _______debug_log.txt) that contains password-reset links. An attacker can trigger a password reset for the Administrator account and...