blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2013-2107

MEDIUM 6.8 CVSS 2.0
Published
May 23, 2014
Last modified
June 16, 2026
NVD status
Modified
Reported by
secalert@redhat.com
Weakness
CWE-352
CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P

Description

Cross-site request forgery (CSRF) vulnerability in the Mail On Update plugin before 5.2.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that change the "List of alternative recipients" via the mailonupdate_mailto parameter in the mail-on-update page to wp-admin/options-general.php. NOTE: a third party claims that 5.2.1 and 5.2.2 are also vulnerable, but the issue might require a separate CVE identifier since this might reflect an incomplete fix.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • mail_on_update_project mail_on_update — Up to and including 5.1.0
  • mail_on_update_project mail_on_update — Version 5.0.0

References