WordPress Plugin Vulnerabilities
YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak
Description
The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them
Proof of Concept
Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ user and monitor the traffic using your preferable tool. Look for var yaySmtpWpData = in the HTTP Response and you'll find all the leaked credentials.
Affects Plugins
Fixed in version 2.2.1
References
Classification
Miscellaneous
Original Researcher
Rafshanzani Suhada
Submitter
Rafshanzani Suhada
Verified
Yes
Timeline
Publicly Published
2022-07-11 (about 6 months ago)
Added
2022-07-11 (about 6 months ago)
Last Updated
2022-07-11 (about 6 months ago)