CVE-2022-2352
Post SMTP < 2.1.7 - Admin+ Blind SSRF
- State
- Published
- Severity
- 7.2 High
- Published
- Sep 26, 2022
- Updated
- May 21, 2025
- Reserved
- Jul 8, 2022
Description
The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-918 Server-Side Request Forgery (SSRF)
Affected Products
| Product | Versions |
|---|---|
Post SMTP Mailer/Email LogUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.