CVE-2023-6496 MEDIUM

CVE-2023-6496: Manage Notification E-mails <= 1.8.5 - Missing Authorization

Vendor Virgial

Product Manage Notification E-mails

Weakness CWE-285

Published January 11, 2024

Last update April 8, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.

Key dates

02Disclosure timeline

January 11, 2024 CVE published

April 8, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-6496 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/285.html

Related vulnerabilities

04Related CVE

CVE-2026-4013 SourceCodester Web-based Pharmacy Product Management System add_admin.php improper authorization CVE-2023-28634 GLPI vulnerable to Privilege Escalation from Technician to Super-Admin CVE-2023-28556 Improper Authorization in HLOS CVE-2025-13807 orionsec orion-ops API MachineKeyController.java MachineKeyController improper authorization CVE-2023-42453 Improper validation of receipts allows forged read receipts in matrix synapse