blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2023-5054

MEDIUM 5.3 CVSS 3.1
Published
September 19, 2023
Last modified
June 17, 2026
NVD status
Modified
Reported by
security@wordfence.com
Weakness
CWE-862
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Description

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attackers to send emails utilizing the vulnerable site's server, with arbitrary content. Please note that this vulnerability has already been publicly disclosed with an exploit which is why we are publishing the details without a patch available, we are attempting to initiate contact with the developer.

Affected products and versions

  • Super Store Finder Super Store Finder — Up to and including 6.9.3
  • superstorefinder super_store_finder — Up to and including 6.9.2

References

  • superstorefinder.net https://superstorefinder.net/ Product
  • superstorefinder.net https://superstorefinder.net/support/forums/topic/super-store-finder-for-wordpress-patch-notes/ Release Notes
  • www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/d31d0553-9378-4c7e-a258-12562aa6b388?source=cve Third Party Advisory
  • nvd.nist.gov Official NVD record