Security readout for executives and security teams
Plain-English summary
This issue lets an outside attacker cause subscriber deletion in the WP SMS WordPress plugin if they can trick a logged-in administrator into clicking or loading a forged request. It is not remote takeover, but it can disrupt SMS subscriber lists and related communications.
Executive priority
Handle in normal vulnerability management unless the plugin supports business-critical SMS lists. Prioritize faster if subscriber loss would affect customer communications, OTP workflows, or compliance messaging. There is no source-backed evidence of active exploitation in the provided bundle.
Technical view
CVE-2023-6980 is a CSRF flaw in WP SMS through version 6.5. Missing or incorrect nonce validation on the wp-sms-subscribers delete action allows unauthenticated attackers to trigger subscriber deletion through administrator interaction. CVSS 3.1 is 4.3, reflecting low integrity impact and required user interaction.
Likely exposure
Exposure is mainly WordPress sites running WP SMS or WSMS plugin versions up to and including 6.5. The provided affected-product metadata is sparse and partly inconsistent, so teams should confirm installed plugin identity and version against vendor records.
Exploitation context
The source bundle does not show CISA KEV listing or cited active exploitation. Practical exploitation requires social engineering a logged-in site administrator into performing an action such as clicking a link. Impact is limited to subscriber deletion based on the provided sources.
Researcher notes
The key control failure is CSRF protection on a destructive admin action. Focus validation on nonce enforcement around the subscribers delete path and on whether the deployed plugin includes the referenced fix. Do not assume broader data access or privilege escalation from these sources.
Mitigation direction
- Identify all WordPress sites using WP SMS or WSMS.
- Upgrade to a vendor-confirmed fixed version newer than 6.5.
- Review the plugin vendor changelog and WordPress plugin page for fix status.
- Restrict administrator sessions and avoid untrusted links while logged into WordPress.
- Restore deleted subscribers from backups if unexpected deletions are found.
Validation and detection
- Inventory installed plugin names and versions across WordPress sites.
- Confirm whether any deployment runs WP SMS version 6.5 or earlier.
- Verify the subscriber delete action requires valid nonce validation in installed code.
- Review subscriber counts, audit logs, and backups for unexplained deletions.
- Check Wordfence and vendor references for updated remediation guidance.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-6980 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N2.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
4.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/94ad6b51-ff8d-48d5-9a70-1781d13990a5?source=cveCVE reference
- https://github.com/wp-sms/wp-sms/commit/0f36e2f521ade8ddfb3e04786defe074370afb50CVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3015006%40wp-sms&new=3015006%40wp-sms&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.