CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
What the vulnerability does
Cross-Site Request Forgery (CSRF) vulnerability in Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue.This issue affects Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue: from n/a through 3.1.82.
Explanation of Vulnerability in Simple Terms
The Brevo Newsletter plugin for WordPress contains a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators. An attacker can craft a malicious webpage that, when visited by an authenticated admin, executes unwanted plugin operations without their knowledge. The vulnerability affects versions up to 3.1.82 and requires the admin to visit a malicious link.
What an attacker can do
Perform unauthorized plugin actions on behalf of an authenticated site administrator.
Potential impact on your site
Attackers can modify plugin settings, email lists, or configurations without your consent if you click a malicious link.
Conditions required to exploit
Site admin must visit a malicious webpage while logged into WordPress.
Key dates
External resources
Related vulnerabilities
