CVE-2020-35234 : The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account

The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there.

Published 2020-12-14 03:15:13

Updated 2020-12-15 23:45:39

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-35234

Wp-ecommerce » Easy Wp Smtp » For Wordpress
Versions before (<) 1.4.4
cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-35234

EPSS FAQ

72.50%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 99 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-35234

WordPress Easy WP SMTP Password Reset

Disclosure Date: 2020-12-06

First seen: 2020-12-19

auxiliary/scanner/http/wp_easy_wp_smtp

Wordpress plugin Easy WP SMTP versions <= 1.4.2 was found to not include index.html within its plugin folder. This potentially allows for directory listings. If debug mode is also enabled for the plugin, all SMTP commands are stored in a debug file. An email must hav

More information

CVSS scores for CVE-2020-35234

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-35234

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-35234

https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/

WordPress Easy WP SMTP plugin fixed zero-day vulnerability. – NinTechNet
Exploit;Third Party Advisory
https://wordpress.org/plugins/easy-wp-smtp/#developers

Easy WP SMTP – WordPress plugin | WordPress.org
Product;Release Notes;Third Party Advisory

CVEs referencing this url

Jump to