CVE-2020-35234 describes an Administrator account takeover vulnerability in the easy-wp-smtp plugin for WordPress, affecting versions prior to 1.4.4. An attacker can exploit this by discovering a debug log file containing password reset links if directory listing is enabled on the wp-content/plugins/easy-wp-smtp/ directory. This vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high confidentiality impact, allowing full administrator account compromise. The vulnerability was exploited in the wild in December 2020, and exploit modules are available in Metasploit and Nuclei, though it has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.4.4CPE matchmatch criteria | cpe:2.3:a:wp-ecommerce:easy_wp_smtp:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.