CVE-2023-7202 Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email Sending

2024-02-2708:30:23

WPScan

github.com

wordpress

csrf

ajax

subscriber

email sending

AI Score

6.2

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

partial

JSON

The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Fatal Error Notify",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.5.3",
        "versionType": "semver"
      }
    ],
    "collectionURL": "https://wordpress.org/plugins",
    "defaultStatus": "unaffected"
  }
]