CVE-2023-1430

CVE-2023-1430 affects the FluentCRM - Marketing Automation For WordPress plugin, versions up to and including 2.7.40. This vulnerability allows unauthenticated attackers to modify subscription data, specifically unsubscribing users or managing their subscriptions. The flaw stems from the plugin's use of an unsalted MD5 hash for subscription control, making it susceptible if an attacker obtains a target's email address. The CVSS score is 3.7 (LOW), indicating a network-based attack with high complexity and a low impact on integrity, with no impact on confidentiality or availability. Despite the low CVSS, the FAUCET Risk Score is 8/100. Currently, there is no evidence of active exploitation, and no public exploit code is available on platforms like Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, aligning with the typical lack of attention for most vulnerabilities.