blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2017-6955

MEDIUM 5.3 CVSS 3.1
Published
March 17, 2017
Last modified
June 17, 2026
NVD status
Modified
Reported by
cve@mitre.org
Weakness
CWE-20
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack.

Affected WordPress components

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • n/a n/a — Versions not specified
  • teleogistic invite_anyone — Up to and including 1.3.13

References

  • www.securityfocus.com http://www.securityfocus.com/bid/96965 Third Party Advisory, VDB Entry
  • github.com https://github.com/boonebgorges/invite-anyone/compare/2ed5266ad3ae40f8db39adf06f450bbad56e2eac...boonebgorges:6121de08df86c5005b657dd67e48aa02c7982855 Third Party Advisory
  • wordpress.org https://wordpress.org/plugins/invite-anyone/changelog/ Release Notes, Third Party Advisory
  • nvd.nist.gov Official NVD record