Easy WP SMTP Plugin for WordPress < 1.4.4 Sensitive Information Disclosure

high Nessus Plugin ID 151189

Language:

New! Plugin Severity Now Using CVSS v3

The calculated severity for Plugins has been updated to use CVSS v3 by default. Plugins that do not have a CVSS v3 score will fall back to CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Synopsis

The remote web server is running a PHP application that is affected by an information disclosure vulnerability.

Description

The Easy WP SMTP Plugin for WordPress running on the remote web server is < 1.4.4. It is, therefore, affected by an unauthenticated information disclosure vulnerability.

Solution

Upgrade the Easy WP SMTP Plugin for WordPress to version 1.4.4 or later.

See Also

http://www.nessus.org/u?9372eb77

http://www.nessus.org/u?8361fc45

https://wordpress.org/plugins/easy-wp-smtp/

Plugin Details

Severity: High

ID: 151189

File Name: wordpress_plugin_easy_wp_smtp_exposure.nbin

Version: 1.5

Type: remote

Family: CGI abuses

Published: 6/30/2021

Updated: 10/19/2021

Dependencies: wordpress_detect.nasl

Risk Information

CVSS Score Source: manual

CVSS Score Rationale: Score based on in depth analysis of the vendor advisory by tenable.

CVSS v2

Risk Factor: High

Base Score: 8.8

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:N

CVSS v3

Risk Factor: High

Base Score: 7.4

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Vulnerability Information

CPE: cpe:/a:wordpress:wordpress

Required KB Items: installed_sw/WordPress, www/PHP

Exploited by Nessus: true

Patch Publication Date: 12/13/2020

Vulnerability Publication Date: 12/7/2020