In the process of scrutinizing the Fatal Error Notify plugin for WordPress, a Cross-Site Request Forgery (CSRF) vulnerability was unearthed. This flaw permits an unauthorized user to manipulate requests on behalf of the victim, enabling the attacker to send erroneous error messages via email. The exploit can involve sending a large volume of HTML-coded messages to the victim’s email, potentially causing disruption and spamming issues. Furthermore, the repeated suspicious activity might lead to the blocking of the WordPress site’s email.

Main info:

PluginFatal Error Notify < 1.5.3
All Time67 768
Active installations8 000+
Publicly PublishedJanuary 29, 2023
Last UpdatedJanuary 29, 2023
ResearcherDmtirii Ignatyev
OWASP TOP-10A5: Broken Access Control
Plugin Security Certification by CleanTalk


November 22, 2023Plugin testing and vulnerability detection in the Fatal Error Notify have been completed
November 22, 2023I contacted the author of the plugin and provided a vulnerability PoC with a description and recommendations for fixing
January 8, 2023The author fixed the vulnerability and released the plugin update
January 20, 2023Registered CVE-2023-7202

Discovery of the Vulnerability

During testing of the plugin, a CSRF vulnerability was found, which allows an unauthorized user to manipulate requests on behalf of the victim and thereby send emails to his email about wordpress site errors. He can make a very large HTML code that sends 100 messages to the victim’s email, thereby spamming him and secondly, because of suspicious activity, he can block the email of wordpress site

Understanding of CSRF attack’s

Cross-Site Request Forgery is an attack where an attacker tricks a victim into performing undesired actions on a web application in which they are authenticated. In the context of WordPress, CSRF vulnerabilities typically involve manipulating requests that trigger actions within the application, often without the victim’s knowledge.

In this case, the CSRF vulnerability in Fatal Error Notify allows an attacker to forge requests that send error messages via email. A real-world example could be the creation of a malicious webpage or email containing crafted requests that, when executed by an authenticated user, result in unauthorized emails being sent without their consent.

Exploiting the Missing Authorization Vulnerability

Exploiting the CSRF vulnerability in Fatal Error Notify involves crafting malicious requests that leverage the victim’s authenticated session. The attacker could create a webpage or email containing hidden forms or JavaScript code that, when executed by an authenticated user, initiates requests to send erroneous error messages via email. This can lead to spamming the victim’s email and potential issues such as email blocking due to suspicious activity.


  <script>history.pushState('', '', '/')</script>
    <form action="https://your_site/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="test&#95;error" />
      <input type="submit" value="Submit request" />

The potential risks associated with this vulnerability are significant. An attacker exploiting this flaw could send a large volume of misleading error messages to the victim’s email, causing disruption and potentially overwhelming the email server. Moreover, the repeated sending of suspicious error messages might trigger automated security measures, leading to the blocking of the WordPress site’s email functionality.

In a real-world scenario, an attacker might craft a phishing email or lure victims to a malicious website, triggering CSRF requests that send erroneous error messages without their knowledge.

Recommendations for Improved Security

To enhance the security of the Fatal Error Notify plugin and mitigate the CSRF vulnerability:

  • CSRF Tokens: Implement CSRF tokens in forms and requests to ensure that actions initiated by users are legitimate.
  • Email Rate Limiting: Implement rate limiting for email notifications to prevent abuse and spamming.
  • User Confirmation: Incorporate mechanisms for user confirmation before executing critical actions, especially those involving email notifications.
  • Security Headers: Utilize security headers such as Content Security Policy (CSP) to mitigate the risk of malicious code execution.
  • Regular Security Audits: Conduct routine security audits to identify and address vulnerabilities, including those related to CSRF.

By adopting these recommendations, the Fatal Error Notify plugin can bolster its security defenses, prevent unauthorized email notifications, and safeguard WordPress installations from CSRF-related exploits.

#WordPressSecurity #MissingAuthorization #WebsiteSafety #StayProtected #MediumVulnerability

Use CleanTalk solutions to improve the security of your website


Create your CleanTalk account

By signing up, you agree with license. Have an account? Log in.
CVE-2023-7202 – Fatal Error Notify – Error Email Sending CSRF

Leave a Reply

Your email address will not be published. Required fields are marked *