CVE-2022-1630

The WP-EMail WordPress plugin before 2.69.0 is vulnerable to CSRF in log deletion due to missing nonce checks. This allows a logged-in attacker to trick an admin into deleting logs via CSRF. A PoC exists in the WP-Email exploit documentation showing an automatic form submission. Remediation: upgr...

CVE-2022-1614

CVE-2022-1614 affects the WP-EMail WordPress plugin up to version 2.69.0. The root cause is that the plugin prioritizes obtaining a visitor IP from certain HTTP headers (e.g., HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR) over PHP’s REMOTE_ADDR, enabling an attacker to bypass IP-based anti-spam restricti...