WordPress Plugin Vulnerability Report – Manage Notification E-mails – Missing Authorization – CVE-2023-6496

Q: What exactly is the vulnerability?

What exactly is the vulnerability? The vulnerability allows an external attacker to access sensitive plugin configuration details and settings without needing to authenticate. The exposed data could contain database credentials, API keys, internal URLs or other details an attacker may leverage in further exploits. It impacts Manage Notification E-mails versions 1.8.5 and below.

Q: I have automatic updates enabled - am I still at risk?

I have automatic updates enabled - am I still at risk? If you have automatic background updates enabled for your plugins in WordPress, your site should have already updated itself to the secure 1.8.6 version or newer. Login and check that you are now running 1.8.6 and you should be safe.

Q: How can I tell if my site has been compromised?

How can I tell if my site has been compromised? Check your server access logs for any unauthorized plugin data exports via the card_famne_export_settings function that may have already occurred. Also scan files for any unauthorized code injections just to be safe. If you find anything suspicious, take your site offline and contact a security professional immediately.

Q: What exactly does Manage Notification E-mails plugin do?

What exactly does Manage Notification E-mails plugin do? This plugin helps manage email notifications delivered from your WordPress site. This includes things like new user registration emails, password reset emails, contact form submissions, and more. Over 100,000 WordPress sites use it.

Q: Should I just delete the plugin to be secure?

Should I just delete the plugin to be secure? You can delete Manage Notification E-mails if you want to take zero risks, but the developer has addressed the vulnerability in the new 1.8.6 version. Updating is likely sufficient as long as you are now on 1.8.6 or higher.

Q: Are other plugins at risk?

Are other plugins at risk? This specific vulnerability only impacts Manage Notification E-mails. However, plugins in general are involved in over half of hacked WordPress sites since they can become outdated. Maintaining plugins is crucial.

Q: How often should I update plugins?

How often should I update plugins? Ideally, enable automatic background updates in WordPress so your plugins update themselves whenever the developers release new versions. If not, manually check and update all plugins at least once per month.

Q: Is my email data compromised?

Is my email data compromised? There is no evidence that attacker would have accessed any private email data via this vulnerability. It exposed plugin configuration details like API keys rather than emails themselves. But take precautions like updating passwords.

Q: Who discovered this vulnerability?

Who discovered this vulnerability? The vulnerability was privately disclosed to the plugin developers by researcher Rafshanzani Suhada back in September 2022. The developer then worked to patch the plugin.

Q: Who can help me secure my site?

Who can help me secure my site? If you need assistance updating plugins, fixing any compromised files, switching email services, or improving your overall WordPress security practices, we offer affordable website maintenance packages for small businesses including handling all of this for you on an ongoing basis.

By Your WP Guy | December 8, 2023

Plugin Name: Manage Notification E-mails

Key Information:

Software Type: Plugin
Software Slug: manage-notification-emails
Software Status: Active
Software Author: virgial
Software Downloads: 612,816
Active Installs: 100,000
Last Updated: December 8, 2023
Patched Versions: 1.8.6
Affected Versions: <= 1.8.5

Vulnerability Details:

Name: Manage Notification E-mails <= 1.8.5 - Missing Authorization
Title: Missing Authorization
Type: Improper Authorization
CVE: CVE-2023-6496
CVSS Score: 5.3 (Medium)
Publicly Published: December 8, 2023
Researcher: Rafshanzani Suhada
Description: The Manage Notification E-mails plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.8.5 via the card_famne_export_settings function. This makes it possible for unauthenticated attackers to obtain plugin settings.

Summary:

The Manage Notification E-mails for WordPress has a vulnerability in versions up to and including 1.8.5 that allows unauthenticated access to plugin settings via the card_famne_export_settings function. This vulnerability has been patched in version 1.8.6.

Detailed Overview:

Researcher Rafshanzani Suhada disclosed that the card_famne_export_settings function in Manage Notification E-mails versions 1.8.5 and below lacks proper authorization checks. This allows any unauthenticated user to export sensitive plugin configuration details via a specially crafted request. An attacker could leverage this to obtain database credentials, API keys, or other sensitive details. Users should update to version 1.8.6 as soon as possible to mitigate risk.

Advice for Users:

Immediate Action: Update to Manage Notification E-mails version 1.8.6 or above.
Check for Signs of Vulnerability: Review server access logs for any unauthorized plugin exports via the card_famne_export_settings function.
Alternate Plugins: Consider using alternative notification plugins like Post SMTP or WP Mail SMTP as a precaution.
Stay Updated: Enable automatic updates in WordPress to receive security fixes promptly.

Conclusion:

The quick response by the developer to patch this vulnerability shows the importance of rapid security updates. Users should install version 1.8.6 immediately to prevent unauthorized access.

References:

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/manage-notification-emails

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/manage-notification-emails/manage-notification-e-mails-185-missing-authorization

Detailed Report:

Keeping your WordPress site secure should be a top priority to protect your business—but we know you have a million other things demanding your attention. Unfortunately, an authorization vulnerability was recently disclosed in the popular Manage Notification E-mails plugin that could put over 100,000 WordPress sites at risk if left unpatched.

The Manage Notification E-mails plugin helps manage email notifications from WordPress. It has over 612,000 downloads and around 100,000 active installs. Versions 1.8.5 and below contain the security flaw.

Specifically, the vulnerability allows an external attacker to access sensitive plugin configuration details and settings without needing to authenticate. The exposed data could contain database credentials, API keys, internal URLs or other details an attacker may leverage in further exploits.

The researcher Rafshanzani Suhada privately disclosed this issue to the plugin developers back in September. The developer has now released Manage Notification E-mails version 1.8.6 to address this vulnerability. However, many users likely have not yet updated.

To protect your website, you should update to version 1.8.6 or newer immediately. You can do this manually via the WordPress admin dashboard, or enable automatic background updates for a more set-and-forget approach.

Also check your server access logs for any unauthorized plugin data exports that may have occurred already. And consider installing other notification plugins, like WP Mail SMTP, as an alternate option should you want additional assurance your email communications remain protected.

Staying on top of plugin updates can feel overwhelming, but is crucial for security. By following basic security best practices, you can avoid hours of headaches down the road.

As a business owner, you don't have time to constantly monitor for WordPress vulnerabilities like this. At Your WP Guy, we become your outsourced IT team to handle security, updates, maintenance and support. Let us fully audit your site and plugins to assess any impact from this issue. We'll update everything to patched versions so you can rest easy knowing your site is locked down.

Focus on your business goals while we focus on your WordPress site's security. Chat with us anytime during business hours, schedule a call or call 678-995-5169 for a free consultation on securing your online presence.