CVE-2023-0766: 
WordPress vulnerability analysis and mitigation

The Newsletter Popup WordPress plugin version 1.2 and below contains a Cross-Site Request Forgery (CSRF) vulnerability, identified as CVE-2023-0766. The vulnerability was publicly disclosed on May 2, 2023, affecting the wp_newsletter_show_localrecord page functionality (WPScan).

The vulnerability stems from the absence of CSRF protection mechanisms in certain areas of the plugin. Specifically, the wp_newsletter_show_localrecord page lacks nonce verification, making it susceptible to CSRF attacks. The vulnerability has been assigned a CVSS score of 4.3 (medium severity) and is classified under CWE-352 (WPScan).

When exploited, this vulnerability could allow attackers to manipulate authenticated users into performing unwanted actions, specifically the deletion of records, without their knowledge or consent (WPScan).

A proof of concept exists demonstrating the vulnerability through the URL path: /wp-admin/admin.php?page=wp_newsletter_show_localrecord&action=delete&rid=1. The attack requires the target user to be logged in to the WordPress admin panel (WPScan).

As of the vulnerability disclosure, no known fix has been released for this issue. Users of the Newsletter Popup plugin should consider implementing additional security measures or temporarily disabling the plugin until a patch becomes available (WPScan).