CVE-2019-20203

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The Authorized Addresses feature in the Postie plugin 1.9.40 for WordPress allows remote attackers to publish posts by spoofing the From information of an email message.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-290

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/V1n1v131r4/Exploiting-Postie-WordPress-Plugin-/blob/master/README.mdExploit, Third Party Advisory
https://postieplugin.com/Product
https://wordpress.org/plugins/postie/#developersRelease Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/10002Third Party Advisory
https://github.com/V1n1v131r4/Exploiting-Postie-WordPress-Plugin-/blob/master/README.mdExploit, Third Party Advisory
https://postieplugin.com/Product
https://wordpress.org/plugins/postie/#developersRelease Notes, Vendor Advisory
https://wpvulndb.com/vulnerabilities/10002Third Party Advisory

Timeline

Published: Jan 2, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-202045.4The Postie plugin 1.9.40 for WordPress allows XSS, as demonstrated by a certain payload with jaVasCript:/* at the beginning and a crafted SV CVE-2019-202058.8libsixel 1.8.4 has an integer overflow in sixel_frame_resize in frame.c.CVE-2019-202085.5dimC_Read in isomedia/box_code_3gpp.c in GPAC from 0.5.2 to 0.8.0 has a stack-based buffer overflow.CVE-2019-202097.5The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow nsecure Direct Object Refere CVE-2019-20216.5In rw_t3t_act_handle_ndef_detect_rsp of rw_t3t.cc, there is a possible out-of-bound read due to a missing bounds check. This could lead to l CVE-2019-202106.1The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Reflected XSS via a search q CVE-2019-202116.1The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via Listing A CVE-2019-202126.1The CTHthemes CityBook before 2.3.4, TownHub before 1.0.6, and EasyBook before 1.2.2 themes for WordPress allow Persistent XSS via the chat CVE-2019-202137.5D-Link DIR-859 routers before v1.07b03_beta allow Unauthenticated Information Disclosure via the AUTHORIZED_GROUP=1%0a value, as demonstrate CVE-2019-202159.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in CVE-2019-202169.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i CVE-2019-202179.8D-Link DIR-859 1.05 and 1.06B01 Beta01 devices allow remote attackers to execute arbitrary OS commands via the urn: to the M-SEARCH method i