CVE-2023-5674
Published: 26 December 2023
Summary
CVE-2023-5674 is a high-severity SQL Injection (CWE-89) vulnerability in Wpvibes Wp Mail Log. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability is a SQL injection flaw, identified as CWE-89, affecting the WP Mail Log WordPress plugin in versions prior to 1.1.3. It stems from insufficient sanitization and escaping of a parameter before its use in a SQL statement, resulting in a CVSS 3.1 score of 8.8.
Attackers with Contributor-level privileges or higher can exploit the issue over the network without user interaction to read, modify, or delete arbitrary data in the database, potentially leading to full compromise of the affected WordPress site.
The WPScan advisories linked in the references identify the affected plugin versions and confirm the SQL injection vector, indicating that updating to version 1.1.3 or later resolves the input-handling weakness. The associated EPSS score has remained flat at 0.1104 with no material increase observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-57966
Vulnerability details
The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.