CVE-2023-1430
Wpmanageninja Fluentcrm ≤ 2.7.40
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-1430 is a medium-severity Use of a One-Way Hash without a Salt (CWE-759) vulnerability in Wpmanageninja Fluentcrm. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data Obfuscation (T1001); ranked in the top 44% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The FluentCRM marketing automation plugin for WordPress is affected by CVE-2023-1430, an authorization bypass that permits unauthenticated modification of subscription data in all versions through 2.8.01. The root cause is the plugin’s reliance on an unsalted MD5 hash to validate subscription-management requests, a weakness catalogued as CWE-759.
An attacker who obtains any subscriber email address can therefore issue crafted requests that unsubscribe the address from mailing lists or otherwise alter its subscription state. No authentication, user interaction, or special network position is required, consistent with the CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:N).
Public references document both the flaw and its remediation: WordPress.org changeset 2899218 and subsequent commits updated the ExternalPages handler to replace the weak hashing mechanism, and the Wordfence advisory recommends upgrading to a version newer than 2.8.01. A proof-of-concept is also available on GitHub.
EPSS remains flat at 0.0517 with no material post-disclosure increase, indicating limited observed exploitation interest to date.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-23681
Vulnerability Data
The FluentCRM - Marketing Automation For WordPress plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.8.01 due to the use of an MD5 hash without a salt to control subscriptions. This makes…
more
it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security associations provide guidance on proper one-way hash usage including salting, reducing the chance of unsalted implementations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including salting for password hashing.
Secure SDLC processes can include password-handling rules but do not guarantee salted hashes.
A.8.26 only requires that security requirements (including use of cryptography per 8.24) be identified and specified during development or acquisition; it does not itself mandate, enforce, or implement salting of one-way hashes and therefore does not stop exploitation of unsalted hashes that remain present.
Secure coding standards explicitly forbid unsalted password hashes and require salting.