CVE-2023-6620

The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin.

Affected products

Post Smtp Mailer

Wpexperts Post Smtp

< 2.8.7

Fix

Available

CVSS 3.1

7.2 HIGH

EPSS

14.1% (96th percentile)

Weakness

CWE-89

NVD status

Modified

Published

2024-01-15