CVE-2022-2352

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2022-2352

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2352.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2022-2352

Published

2022-09-26T12:35:32Z

Modified

2026-07-15T01:48:56.831899123Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Post SMTP < 2.1.7 - Admin+ Blind SSRF

Details

The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users such as admin to perform blind SSRF on multisite installations for example.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2352.json",
    "cwe_ids": [
        "CWE-918"
    ],
    "cna_assigner": "WPScan",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "2.1.7"
                },
                {
                    "last_affected": "2.1.7"
                }
            ],
            "source": "AFFECTED_FIELD"
        },
        {
            "extracted_events": [
                {
                    "fixed": "2.1.7"
                }
            ],
            "source": "DESCRIPTION"
        }
    ]
}

References

Affected packages

Git / github.com/wpexpertsio/post-smtp

Affected ranges

Type

GIT

Repo

https://github.com/wpexpertsio/post-smtp

Events

Introduced

Fixed

1e2224f91dc1dfd9f218ab86abeb6c6c2c58f7ca

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.7"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:wpexperts:post_smtp:*:*:*:*:*:wordpress:*:*"
}

Affected versions

2.*

2.0.1

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.19

2.0.2

2.0.20

2.0.21

2.0.22

2.0.23

2.0.24

2.0.25

2.0.25-beta.1

2.0.26

2.0.27

2.0.3

2.0.4

2.0.5

2.0.6

2.0.7

2.0.8

2.0.9

2.1

2.1-beta.1

2.1.1

2.1.1.1

2.1.2

2.1.2-beta-1

2.1.2-rc.1

2.1.2-rc.2

2.1.4

2.1.4-beta.1

2.1.4-rc.1

2.1.4-rc.2

2.1.6

v.*

v.1.9.0

v.1.9.1

v.1.9.2

v1.*

v1.9.3

v1.9.4

v1.9.5

v1.9.6

v1.9.7

v1.9.8

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-2352.json"