### [CVE-2023-1430](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1430)
![](https://img.shields.io/static/v1?label=Product&message=Email%20Marketing%2C%20Newsletter%2C%20Email%20Automation%20and%20CRM%20Plugin%20for%20WordPress%20by%20FluentCRM&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3D%202.7.40%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-759%20Use%20of%20a%20One-Way%20Hash%20without%20a%20Salt&color=brighgreen)

### Description

The FluentCRM - Marketing Automation For WordPress  plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 2.7.40 due to the use of an MD5 hash without a salt to control subscriptions. This makes it possible for unauthenticated attackers to unsubscribe users from lists and manage subscriptions, granted they gain access to any targeted subscribers email address.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/karlemilnikka/CVE-2023-1430
- https://github.com/nomi-sec/PoC-in-GitHub