CVE-2023-6980 in WP SMS Plugin
Summary
by MITRE • 01/03/2024
The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 06/06/2025
The WP SMS plugin for WordPress represents a widely used messaging solution that integrates with various WordPress platforms including WooCommerce and GravityForms. This particular vulnerability affects all versions up to and including 6.5, exposing a critical cross-site request forgery weakness in the plugin's subscriber management functionality. The vulnerability specifically targets the wp-sms-subscribers page where the delete action lacks proper nonce validation, creating a significant security risk for WordPress administrators and website owners who rely on this plugin for their communication infrastructure.
The technical flaw manifests as a missing or incorrect nonce validation mechanism within the plugin's delete functionality. Nonce validation serves as a cryptographic token that ensures requests originate from legitimate sources and prevent unauthorized actions. When this validation is absent or improperly implemented, attackers can craft malicious requests that appear to come from authenticated administrators. The vulnerability operates through a simple yet effective attack vector where unauthenticated attackers can construct forged requests to delete subscribers from the WordPress database, essentially allowing them to manipulate the subscriber list without proper authorization.
This vulnerability creates a substantial operational impact on WordPress websites utilizing the WP SMS plugin, particularly those with large subscriber databases or those managing sensitive user communications. The attack requires only social engineering to trick administrators into clicking malicious links, making it particularly dangerous as it can be executed without requiring direct access to the website's administrative interface. The consequences extend beyond simple data deletion, as compromised subscriber lists can lead to service disruption, potential data exposure, and damage to user trust. Additionally, the vulnerability can be exploited to cause denial of service conditions by systematically removing subscribers, impacting the plugin's core functionality and potentially affecting related e-commerce or form processing operations.
The vulnerability maps directly to CWE-352, which specifically addresses Cross-Site Request Forgery weaknesses in software applications. From an ATT&CK framework perspective, this represents a technique that leverages social engineering and authentication bypass methods to achieve unauthorized actions within a target system. The attack chain typically involves initial reconnaissance to identify vulnerable installations, followed by crafting malicious payloads that exploit the missing nonce validation. The attack surface is particularly concerning given that WordPress plugins often have broad administrative privileges and can be easily targeted by attackers seeking to compromise entire websites through vulnerable components.
Effective mitigation strategies should include immediate plugin updates to versions that address the nonce validation issue, implementing additional security measures such as two-factor authentication for administrative access, and conducting thorough security audits of all installed plugins. Administrators should also consider implementing web application firewalls that can detect and block suspicious requests targeting known vulnerability patterns. The most critical immediate action is to upgrade to the patched version of the WP SMS plugin, as this addresses the core nonce validation flaw that enables the attack. Additionally, regular monitoring of plugin security advisories and maintaining updated security practices across all WordPress installations will help prevent similar vulnerabilities from being exploited in the future.