Cyber Resilience

CVE-2023-5674

HighPublic PoC

Published: 26 December 2023

Published
26 December 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1104 93.6th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-5674 is a high-severity SQL Injection (CWE-89) vulnerability in Wpvibes Wp Mail Log. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability is a SQL injection flaw, identified as CWE-89, affecting the WP Mail Log WordPress plugin in versions prior to 1.1.3. It stems from insufficient sanitization and escaping of a parameter before its use in a SQL statement, resulting in a CVSS 3.1 score of 8.8.

Attackers with Contributor-level privileges or higher can exploit the issue over the network without user interaction to read, modify, or delete arbitrary data in the database, potentially leading to full compromise of the affected WordPress site.

The WPScan advisories linked in the references identify the affected plugin versions and confirm the SQL injection vector, indicating that updating to version 1.1.3 or later resolves the input-handling weakness. The associated EPSS score has remained flat at 0.1104 with no material increase observed.

EU & UK References

Vulnerability details

The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

wpvibes
wp mail log
≤ 1.1.3

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References