CVE-2023-7202

The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/	Exploit Third Party Advisory
https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/	Exploit Third Party Advisory
https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:verygoodplugins:fatal_error_notify:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-02-27 09:15

Updated : 2025-05-01 14:31

NVD link : CVE-2023-7202

Mitre link : CVE-2023-7202

CVE.ORG link : CVE-2023-7202

JSON object : View

Products Affected

verygoodplugins

fatal_error_notify

CWE

CWE-352

Cross-Site Request Forgery (CSRF)

{"id": "CVE-2023-7202", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2024-02-27T09:15:37.397", "references": [{"url": "https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/", "tags": ["Exploit", "Third Party Advisory"], "source": "contact@wpscan.com"}, {"url": "https://research.cleantalk.org/cve-2023-7202-fatal-error-notify-error-email-sending-csrf/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://wpscan.com/vulnerability/d923ba5b-1c20-40ee-ac69-cd0bb65b375a/", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-352"}]}], "descriptions": [{"lang": "en", "value": "The Fatal Error Notify WordPress plugin before 1.5.3 does not have authorisation and CSRF checks in its test_error AJAX action, allowing any authenticated users, such as subscriber to call it and spam the admin email address with error messages. The issue is also exploitable via CSRF"}, {"lang": "es", "value": "El complemento Fatal Error Notify de WordPress anterior a 1.5.3 no tiene autorizaci\u00f3n y CSRF verifica su acci\u00f3n test_error AJAX, lo que permite a cualquier usuario autenticado, como un suscriptor, llamarlo y enviar spam a la direcci\u00f3n de correo electr\u00f3nico del administrador con mensajes de error. El problema tambi\u00e9n se puede explotar a trav\u00e9s de CSRF."}], "lastModified": "2025-05-01T14:31:33.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:verygoodplugins:fatal_error_notify:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "A3124452-DBFE-40A9-86BF-F4CB387F0807", "versionEndExcluding": "1.5.3"}], "operator": "OR"}]}], "sourceIdentifier": "contact@wpscan.com"}