{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-04T12:59:07.271","vulnerabilities":[{"cve":{"id":"CVE-2023-3407","sourceIdentifier":"security@wordfence.com","published":"2023-06-28T03:15:09.243","lastModified":"2026-06-17T06:14:00.810","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 10.40. This is due to missing or incorrect nonce validation when sending test emails. This makes it possible for unauthenticated attackers to send test emails with custom content to users on sites running a vulnerable version of this plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link."},{"lang":"es","value":"El plugin Subscribe2 para WordPress es vulnerable a ataques de tipo Cross-Site Request Forgery (CSRF) en versiones hasta la 10.40 inclusive. Esto se debe a la falta o incorrecta validación nonce al enviar correos electrónicos de prueba. Esto hace posible que los atacantes no autenticados envíen correos electrónicos de prueba con contenido personalizado en los sitios que ejecutan una versión vulnerable de este plugin a través de una petición falsificada pudiendo engañar a un administrador del sitio para realizar una acción como hacer clic en un enlace.   "}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"wedevs","product":"Subscribe2 – Form, Email Subscribers & Newsletters","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"10.40","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","baseScore":4.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":1.4}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-02-05T18:29:17.873682Z","id":"CVE-2023-3407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@wordfence.com","type":"Secondary","description":[{"lang":"en","value":"CWE-352"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:subscribe2_project:subscribe2:*:*:*:*:*:wordpress:*:*","versionEndIncluding":"10.40","matchCriteriaId":"34325F77-97FF-4F8E-AA88-30E2B687950B"}]}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/2930676","source":"security@wordfence.com","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=cve","source":"security@wordfence.com","tags":["Third Party Advisory"]},{"url":"https://plugins.trac.wordpress.org/browser/subscribe2/trunk/admin/send-email.php#L12","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://plugins.trac.wordpress.org/changeset/2930676","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/92b4d800-2895-4f7b-8b3b-ee6df75a7908?source=cve","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}