CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.
Explanation of Vulnerability in Simple Terms
Emails Catch All versions 3.5.3 and earlier contain an authentication bypass vulnerability. An attacker with low-level user access can read, modify, or delete sensitive data and disrupt site functionality. The vulnerability requires network access but no user interaction. Sites running affected versions should update immediately.
What an attacker can do
Read, modify, or delete sensitive data; disrupt site availability with low-level user credentials.
Potential impact on your site
Unauthorized users can access and alter email catch-all settings, potentially exposing or losing email data.
Conditions required to exploit
Attacker needs a low-privilege user account on the site; network access to the vulnerable component.
Key dates
External resources
Related vulnerabilities
