Return-Path: <1axbm3hx8xzk04bl7mfrau8onpkx0ec83d5i72-help=rommedia.eu@4354010m.wordfence.com>
Delivered-To: help@rommedia.eu
Received: from web05.ouiheberg.com
	by web05.ouiheberg.com with LMTP
	id 4H2JIqLMnmUcix8Aw70cEg
	(envelope-from <1axbm3hx8xzk04bl7mfrau8onpkx0ec83d5i72-help=rommedia.eu@4354010m.wordfence.com>)
	for <help@rommedia.eu>; Wed, 10 Jan 2024 17:58:10 +0100
Return-path: <1axbm3hx8xzk04bl7mfrau8onpkx0ec83d5i72-help=rommedia.eu@4354010m.wordfence.com>
Envelope-to: help@rommedia.eu
Delivery-date: Wed, 10 Jan 2024 17:58:10 +0100
Received: from bid458m.4354010m.wordfence.com ([158.247.16.68]:64073)
	by web05.ouiheberg.com with esmtps  (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.96.2)
	(envelope-from <1axbm3hx8xzk04bl7mfrau8onpkx0ec83d5i72-help=rommedia.eu@4354010m.wordfence.com>)
	id 1rNbtu-008fjA-3D
	for help@rommedia.eu;
	Wed, 10 Jan 2024 17:58:10 +0100
Received: by 172.16.227.89 with SMTP id azkdahsnrah60swnxk9e6s6komtas7gea2kcmbcui;
        Wed, 10 Jan 2024 16:57:27 GMT
DKIM-Signature: v=1; s=hs1; d=4354010m.wordfence.com; 
        i=@4354010m.wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=OLW/xaVOddJYt27PKOlDgF6XQPeOJtWlW+kEQX6plEc=; 
        b=OCheafpomF3k6CmywjhuXuRKgF7h36DdOLFAvkUZv825UoAKXNDiDd7qPIPxok
         9Ws18Nba46aXfRWj25e+iLGSnzpJQ6lNbR9t/wKL6j1am22IlJ1ZTNhipBOkz8F
         eS4FKmn8IrFqd419QCmnJLoj45g+YqRgEw6giXV4v8EUgN+Ca4G0UHSZw0x0u4E
         au/wBWhEAFm9OGUNzufPQ47RtM1O6AmTLSoF1HVgSW9uIhfHDiHy9IK+dT3Z3lN
         PZcWICVZ/IunWun4JBcJwtUwVLZ576J6ebKtALeEdIkHRpGSDh7dt14jtyHV2ag
         X+vddr1oEe56rcHfT3SQbF0Bc+5A==; q=dns/txt; t=1704905846; 
        x=1705168646;
DKIM-Signature: v=1; s=hs1; d=wordfence.com; i=@wordfence.com; 
        h=sender:from:from:reply-to:to:to:cc:cc:subject:subject:list-unsubscribe:form-sub:feedback-id; 
        a=rsa-sha256; c=relaxed/relaxed; 
        bh=OLW/xaVOddJYt27PKOlDgF6XQPeOJtWlW+kEQX6plEc=; 
        b=KmWYO+l/kRcY4BzULtKunOcU3eMF87Zk7c0dnFxlMv/UPu4wqKtVNpbooQuDLP
         ZaJs+QTRQAvZcWWWx+wgLPoY8I1E339bedQsMPfrJeZVq4BJwUSMyPC7C/VPIaW
         BuWZIpFL8FxchXjZkCLGX4DtX6L95Gccclq490i9lGgacYluIoxDcvv3Y4fTVe4
         R2SScy2kELhGlYa/vushkanPB6oPTUSwlvWVpympEiD5/JEEmERknGF/6rfdWfR
         vo+mO6xwEW8KnPVCW0TZSJiTJVmtM/tLToVmEI30+EQBWOl+FeSZ9dB/v8qPXF1
         2LIDYI2SAWAKoaDpHQEOCLYlpepg==; q=dns/txt; t=1704905846; 
        x=1705168646;
X-HS-Cid: 1axff12kpr45ozwo6md582mtp87d0qslkz6mb2
List-Unsubscribe: <mailto:1axcpuxlmq2a82cvkccp08wiue8ymxvp4prt6q-help=rommedia.eu@4354010m.wordfence.com?subject=unsubscribe>
Date: Wed, 10 Jan 2024 08:57:27 -0800
From: Wordfence <list@wordfence.com>
Reply-To: no-reply@wordfence.com
To: help@rommedia.eu
Message-ID: <1704905365951.ffc775b0-0695-4430-86a7-3f48707bebdf@4354010m.wordfence.com>
Subject: [WordPress Security] Type Juggling Leads to Two Vulnerabilities in
 POST SMTP Mailer WordPress Plugin
MIME-Version: 1.0
Content-Type: multipart/alternative; 
	boundary="----=_Part_25895708_1353425290.1704905846186"
X-Report-Abuse-To: abuse@hubspot.com (see
 https://policy.hubspot.com/abuse-complaints)
X-Spam-Status: No, score=-2.7
X-Spam-Score: -26
X-Spam-Bar: --
X-Ham-Report: Spam detection software, running on the system "web05.ouiheberg.com",
 has NOT identified this incoming email as spam.  The original
 message has been attached to this so you can view it or label
 similar future email.  If you have any questions, see
 root\@localhost for details.
 Content preview:  Critical Vulnerability allows attackers to completely takeover
    affected sites. Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3prCCW6N1vHY6lZ3kZW15810K6cqhSQW22B9521QJc4rW7rXzMz7L_kb-W1Y5y-Y81Y82tW4vJxhx8wGfjvW
    [...] 
 Content analysis details:   (-2.7 points, 5.0 required)
  pts rule name              description
 ---- ---------------------- --------------------------------------------------
  0.0 URIBL_BLOCKED          ADMINISTRATOR NOTICE: The query to URIBL was
                             blocked.  See
                             http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block
                              for more information.
                             [URIs: wordfence.com]
  0.0 URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             dbl.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wordfence.com]
  0.0 RCVD_IN_ZEN_BLOCKED_OPENDNS RBL: ADMINISTRATOR NOTICE: The query
                              to zen.spamhaus.org was blocked due to
                             usage of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [158.247.16.68 listed in zen.spamhaus.org]
  0.0 URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to
                             zen.spamhaus.org was blocked due to usage
                             of an open resolver. See
                             https://www.spamhaus.org/returnc/pub/
                             [URIs: wpexperts.io]
 -0.0 SPF_PASS               SPF: sender matches SPF record
  0.0 HTML_FONT_LOW_CONTRAST BODY: HTML font color similar or
                             identical to background
  0.0 HTML_MESSAGE           BODY: HTML included in message
 -0.1 DKIM_VALID_AU          Message has a valid DKIM or DK signature from
                             author's domain
 -0.1 DKIM_VALID             Message has at least one valid DKIM or DK signature
  0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                             valid
 -0.1 DKIM_VALID_EF          Message has a valid DKIM or DK signature from
                             envelope-from domain
 -0.0 T_SCC_BODY_TEXT_LINE   No description available.
 -2.5 DKIMWL_WL_HIGH         DKIMwl.org - High trust sender
X-Spam-Flag: NO

------=_Part_25895708_1353425290.1704905846186
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Critical Vulnerability allows attackers to completely takeover affected sit=
es.

Wordfence-Logo.png (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkz=
DB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3prCCW6N1vHY6lZ3kZW15810K6cqhSQW22=
B9521QJc4rW7rXzMz7L_kb-W1Y5y-Y81Y82tW4vJxhx8wGfjvW3Rmn0Q27wxv0W7YMPtW8RYl-2=
W3SwDLB2kX0xrMbgyRx88pJ6N6zNl2tkryrnW5gvZRv88j2MyW6jcZH176zqfXN17rrXjtGDhnN=
65b9PpDB6V1V1JKzp2VZjVTW5TBs8b3-nW9JN8S5Lr7Tzxz5W4fSHfk80YdNMW492H8c6px-mHW=
5PgVQh5lnr33W8w28VH8SVYz1W1ZDT3b4dk-12f580vzH04 )

FeaturedImage_Wordfence_71.02 (https://email.wordfence.com/e3t/Ctc/GC+113/c=
wG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZ85m_5PW5BWr2F6lZ3p-W5cs5=
_h5ctsvnW3Vf3f-6tcsq5W4b2_fm48ClF1W71PGWS8Dh4JFW24hVHX4q3-FXN4TwhXtnw0v8W1S=
kXc65dlb73W2-zk047nh61WW3b3qJZ2-0kvyW5hxtXZ6VLgfFV-wXKs5b4YpsW92v9Zr4pKMm4W=
5nRm078G73YtMfB07HbglQLN1dqwTTd2fb6W7RV2ch5Jt1TkW2j0zkc2zrdDYVxq7PR7kvfwrW5=
xtcTH1XSnN9W3lV5jH9cPFmcW1ZJc8N5qtLplW6S01ZQ5THhHDV9d9FP4WWXm-W1B0ctC1Sgwp3=
W8NdwnP5ldmxwN68PzTFLFxhSW88Wj0X7lxPLLW2p_Dbd2q6hrBW8CbGT799xcL2W8w40v35DJh=
2DW7ZBQCM72VnD5W2k0-Cq26g12XW4sLNGr7tNdKhW79dc9D16zlGQdyNFgx04 )

On December 14th, 2023, during our Bug Bounty Program Holiday Bug Extravaga=
nza, we received a submission for an Authorization Bypass vulnerability in =
POST SMTP Mailer (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB=
6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23prCCW7lCdLW6lZ3m2W3SdVhP2SZn4-W4Lk0=
6y8N4pHlN1mjxps9d3WFW5RBMhL3NZ5-dW4dHLgg7qt3cxW5W-R9l7JyYHkW3RWHsn3zWsclN63=
4fsLZBsYYW3cbMy9698863W49wWnp5JBg0RW2TDKT08fJzySW7jgLGX1nygtGW6qm6pj2VqlJBW=
8cGS4n1Hwrh7W6P-4kP7z3jY1VxFVJX5x828XW77RT5D3dvWMmW8yfdfC65j25QN2wwcbDr1MkT=
W21xlQl6Nf_zsW4zZSpJ7PHztfW80fcdr4lNJWKW6WxKBY6yDKlFW7SclhH59G59lf7-fRHC04 =
) , a WordPress plugin with over 300,000+ active installations. This vulner=
ability makes it possible for unauthenticated threat actors to reset the AP=
I key used to authenticate to the mailer and view logs, including password =
reset emails on WordPress sites that use this plugin. We also received anot=
her submission shortly after for an Unauthenticated Stored Cross-Site Scrip=
ting vulnerability in POST SMTP Mailer plugin from another researcher. This=
 vulnerability enables threat actors to inject malicious web scripts into p=
ages.

Special props to Ulyses Saicha (https://email.wordfence.com/e3t/Ctc/GC+113/=
cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3prCCW95jsWP6lZ3n1N1Wq=
6y9hnTRFN3F11mWDV-q0W2nK7ts43_h8bVr0b9z3Jp--FVYYrd53y8B7kW3zHDng1K7ChCW8DWW=
_Z8K9r76W2YPf8j1r15VfW2XPtff55FX58W2rg21M8NnCrMW34ch_s46LP20W8lqvB_1sH-PFW8=
3NV3929LrkbW8XKcB221JLWgVRw8lJ2Qzn2bW6lVVp07W69zsW7HPtsT53Fn22W4Ytp3y8YpVJc=
W1M8FHJ1B9JD0V41jML6g4VKhW4FyD8z2Yyd1CW6r213_6KYvs1W4fh8yW2VShCqW4b_W7_7H_3=
_pW75KZ499jXgV8W9dwl7N3zqjtkVt2zJk5bKNY0W53qvxP5nh98JW7kMb6s8jVRwZV6QnqD8cM=
MT-f7VfSdx04 )  and Sean Murphy (https://email.wordfence.com/e3t/Ctc/GC+113=
/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3prCCW95jsWP6lZ3nJW2K=
KdBf86JWN1W59jj9H2CvG6HW8tQ_k22gz0dXW5yCcVz2GnPvKW94Nr3n35ct31W71NSPJ1lmlXS=
N8szK95X8cJKW65_th38m4kS9W1m5hgv3B55K6W7f0X3Q26CVzDVQ-n1p6M5_ZSW7FxPQX8d8mJ=
2W4psJPh7S76_dN2jw10mc7pCfW1B-GJB1fX0wpN7htCcXNBlPJW68s-4J6_gqVSW2nQr-L3mHL=
mJW6NlpTk8M4VmgW1tG5Sv3GJdQ1W7Yb3sJ4w8ztfVMJ7kC1rBNN1W33BL6q3qlN65N8HfTXt1S=
tggW57srfK3WZmgRW2M9DCq5X5v8VW10WKHx54Ytd4W2P3Wn4427f18F71yKHyD64pW6dXKJJ6R=
1tRVf4gJXPM04 ) , who discovered and responsibly reported these vulnerabili=
ties through the Wordfence Bug Bounty Program (https://email.wordfence.com/=
e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7=
Y8-PT6lZ3lvW31qLdY6mfVf0N3d4WwXr5lgDW6Qj0K_83V0sxW6VTjky49MwY6N6m9Xs2rtjdQW=
39WN723_Lq9JW7QPncm8nJg2fN1n-t1xwMSzlW3qb-GX4_7xf9W5_Z7sw3czn17W6NKHgJ2336W=
7W5KPLbZ5m5mpXW8NskcV2gyZhkW3cV7Lz3mLlfcW262-XR7xwJl7W6rmPJr7MxYzhW16bTzM2Y=
Z7Z7W3BSPb92BczGhW52MSGv71G-tYW6KtMp847xfVsW3FPY774n0G48W1c1v4h6KzRV9W7Kj3S=
h7RgWyXW8NDT5k5fzj23W67-x91174pK5W1stMYP3mGbSFf4-CclM04 ) . These researche=
rs respectively earned bounties of $4,125 and $825 for their discoveries du=
ring our Bug Bounty Program Extravaganza.

Wordfence Premium (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3kZW4sk0Q27M4TT5W1f9=
TWF82V9n-VnSL5J2g-SsdW3d_frt8NF8tWW4gY0Yz6mLyC8W9bw4Zm5WGxXZW2SztVj5zqH45W2=
gD28_3htxGbW8BJFQv2-v8xTW8vv8wt4q0KWQW3TLGhm8rbFrYW9l91bT8TW7pRVqk85R4CyR1g=
N831hZg110srW6kVX-P7JDHzgV9hF5C4hgmKBW8gGTmQ8g2Qx9W7fgsS-8x5NwzW2bcJvY8_jyW=
PW7LFBH_649fdzW6_Bt5L18JrK5W8m6Bvj2DSd50W5w0Rb21ZKnzZW4rqrZn5ngGddW8pJ0MS4r=
qtxHW96wJ2v13CCj2f71gs2-04 ) , Wordfence Care (https://email.wordfence.com/=
e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7=
Y8-PT6lZ3lHW8gXN2f4CNClnW7bBfbT7HKNScW63x2l493xpBnVwqlRT98LSj4W5vt5SP1dr7jR=
N6DyCRd3Pp_rW4x2wFk2rKC7GVsG88h3mx9Q8W1lbltn1-WwNGN6R1PzpS2841W41NHC04Py3bJ=
W4Hv_kX1ymwkwW6NFRmD4ykbSXW7s_gyx86bCjgW3wqqtl4Z_mKhW7srPYZ3b3FLHW2dW3hW2g8=
05hW2hmlv02VfZ05W5hzFww4Ky9ZjW5p-K9V2bD9k4N5GW3LZp6nLSVC1bV-6Qv3HjW5R22LM1K=
3ZlLW66_z1P3dqh__W77JP0_1KFYh5W11DHLP1MDyf_f6L3ZgM04 ) , and Wordfence Resp=
onse (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs=
72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3kMW8CSzjc1CXpLDW10j4q93qF9yRW94s=
WNy7Gyq5XW8C_8dP3-Fz9VW2fPd-S4dcL4qW6-zbY71HVXYdVmG43G6cWVLrW8z36dK64QcX3W7=
zM21N5scTc1W8sl8ch7pYMWfW2htW9T4m0MC_W8jhBKJ18xt66W7ycM6K1HBWG1W3_nBZH71PQk=
vW8_MRBW5MjVHFW5_HKXh5x62J2W5XQGbX2TtvzBVh4Hr311sF9cN3-W_JTrFzHNW5Px-XQ73SY=
lhN62rmLwftX_5W95hfmX2GN7pNW5DxCqH5-k6pmW2-yQ2024M4hrN8KFdCsHysFvW77PnwX5dg=
0xkf20mNGl04 )  users received a firewall rule to protect against any explo=
its targeting these vulnerabilities on January 3, 2024. Sites still using t=
he free version of Wordfence will receive the same protection on February 2=
, 2024.

We contacted WPExperts.io on December 8, 2023 for a separate vulnerability,=
 and received a response on December 10, 2023. After providing full disclos=
ure details, the developer released a patch on January 1, 2024. We would li=
ke to commend the WPExperts.io team for their prompt response and timely pa=
tch.

We urge users to update their sites with the latest patched version of POST=
 SMTP Mailer, version 2.8.8 at the time of this writing, as soon as possibl=
e.

CONTINUE READING ON THE BLOG
(https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8=
hkW87_Sgk5868yQN6-TNZ85m_5PW5BWr2F6lZ3p-W5cs5_h5ctsvnW3Vf3f-6tcsq5W4b2_fm48=
ClF1W71PGWS8Dh4JFW24hVHX4q3-FXN4TwhXtnw0v8W1SkXc65dlb73W2-zk047nh61WW3b3qJZ=
2-0kvyW5hxtXZ6VLgfFV-wXKs5b4YpsW92v9Zr4pKMm4W5nRm078G73YtMfB07HbglQLN1dqwTT=
d2fb6W7RV2ch5Jt1TkW2j0zkc2zrdDYVxq7PR7kvfwrW5xtcTH1XSnN9W3lV5jH9cPFmcW1ZJc8=
N5qtLplW6S01ZQ5THhHDV9d9FP4WWXm-W1B0ctC1Sgwp3W8NdwnP5ldmxwN68PzTFLFxhSW88Wj=
0X7lxPLLW2p_Dbd2q6hrBW8CbGT799xcL2W8w40v35DJh2DW7ZBQCM72VnD5W2k0-Cq26g12XW4=
sLNGr7tNdKhW79dc9D16zlGQdyNFgx04 )

Vulnerability Summary from Wordfence Intelligence

Description: POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notific=
ations and Best Mail SMTP for WordPress <=3D 2.8.7 =E2=80=93 Authorization =
Bypass via type connect-app API (https://email.wordfence.com/e3t/Ctc/GC+113=
/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNYT7lxC-W50l5tj6lZ3p7VVT=
V-r98Vk62V4pxtz1qn1nTW21B98f3Z_yGpW1vrxwz78K4jTVK4nPj7WWzjDMqgt0Hp00hpW7HNY=
pw5CF4HJW87XrTN7vJTFSN5rJ7HkrNX2pW7plzH56qSJXpW5Gghdf7SCBvhW5p7SYf3bp-9SW3F=
KSxb5pScf7W2tPPns5K20XyW8rgj7g8Wfxn_VX0vRR1K8GB_W6X6KCP2mSFZqW8Wbcdb41Hq3PW=
5z79ld47hHyMW5Hz9hB7CND4YW5688pS2F_BDnW4jkS_J6PM7z3W5VqR5S2bKpzlW6mBSq720qZ=
CjN30gnvpstgJZVnNl5f5nZ_J0W6gvNG114pjMNW2Wnkwm7GCmKnW6D6Wy35gNBY2N5Q8RGVMFR=
pjW6dRSP112-T8WW25M8476cSl2MW7Yfbrj558x3NW8v_CsD8p_KwXW59sk493KkTcBW4-tRvH1=
8s2J3VZ5gyt8yQfXmW1ql2kH6vLBF6W8lQDG-1xnzGkN5c-gjFJbYphN8TRmymq5y9TW4d-YBR7=
sgSWSW3bZKmY1vDn6MW2CLfKy69s_stMm9Dk_L-3kqW7-5K2K6BKRtPW5Zm4vB4SP2gXN8mwmfF=
q47GFf1whV5z04 )

Affected Plugin: POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Not=
ifications and Best Mail SMTP for WordPress

Plugin Slug: post-smtp

Affected Versions: <=3D 2.8.7

CVE ID: CVE-2023-6875

CVSS Score: 9.8 (Critical)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Researcher/s: Ulyses Saicha (https://email.wordfence.com/e3t/Ctc/GC+113/cwG=
7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3prCCW95jsWP6lZ3n1N1Wq6y9=
hnTRFN3F11mWDV-q0W2nK7ts43_h8bVr0b9z3Jp--FVYYrd53y8B7kW3zHDng1K7ChCW8DWW_Z8=
K9r76W2YPf8j1r15VfW2XPtff55FX58W2rg21M8NnCrMW34ch_s46LP20W8lqvB_1sH-PFW83NV=
3929LrkbW8XKcB221JLWgVRw8lJ2Qzn2bW6lVVp07W69zsW7HPtsT53Fn22W4Ytp3y8YpVJcW1M=
8FHJ1B9JD0V41jML6g4VKhW4FyD8z2Yyd1CW6r213_6KYvs1W4fh8yW2VShCqW4b_W7_7H_3_pW=
75KZ499jXgV8W9dwl7N3zqjtkVt2zJk5bKNY0W53qvxP5nh98JW7kMb6s8jVRwZV6QnqD8cMMT-=
f7VfSdx04 )

Fully Patched Version: 2.8.8

Bounty Awarded: $4,125.00

The "POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notifications a=
nd Best Mail SMTP for WordPress" plugin for WordPress is vulnerable to unau=
thorized access of data and modification of data due to a type juggling iss=
ue on the connect-app REST endpoint in all versions up to, and including, 2=
.8.7. This makes it possible for unauthenticated attackers to reset the API=
 key used to authenticate to the mailer and view logs, including password r=
eset emails, allowing site takeover.

Description: POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notific=
ations and Best Mail SMTP for WordPress <=3D 2.8.7 =E2=80=93 Unauthenticate=
d Stored Cross-Site Scripting via device (https://email.wordfence.com/e3t/C=
tc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNYT7lxC-W50l5tj=
6lZ3nHW2rSlCc69HcbHN3-z2dZTP3MWV3Mpck4d2X2VW5R4BFR40C-MwW3J2PZN8GP3HWW3-HgY=
t5Lj8L3W772pCV6BYZHkW2yjd4x4cfKZ_W4Dtfk71_d56cW3ZQ-DN7Q-Gh4W1pgZsV57h3X-VmH=
yBm4w419DW3x6bBQ2Tkn6bW3dnxrG48pvW6W5W_WSW3Kq19QW2s3HCy7ydXDBW8TGvwj4NSKrqW=
2qTbLX5glp9qVfKrZY4WRcLCW2lV9T773T9MmW5NHhX62cYb0LW6yZ3jK7F3mbnW1mnzLm7yNHF=
5VMbTp98_m2GSW2dXjzC7XDgwkVTzWYd4jsyrJW35GvXP40RZhBW35VpBy9jw8xGW96grr-8q45=
zlW2PN0Bx2YGnk7W5nsZch3DwrqlW2XjpQF2KnFqYW5V1HY_5c1QbtN3mbNd6kGy_nW8tsD8F58=
0Y-dN1PDwSMss2dvN2ZTC5F1GJq6W6lLyqr3vjl5-VvH-TX8mHQcDW4RH9lT57zc2kW3GgZ9-4V=
VYLWW1vBVKK70XSB0N7v23pJtmG41VVH-sW1d4MfrW8W4SkM99-DWXW8FSkXD14pm1nW1HVvmy2=
w0j6pW5jYbZD26jKFqf5F5_l804 )

Affected Plugin: POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Not=
ifications and Best Mail SMTP for WordPress

Plugin Slug: post-smtp

Affected Versions: <=3D 2.8.7

CVE ID: CVE-2023-7027

CVSS Score: 7.2 (High)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Researcher/s: Sean Murphy (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R=
04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3prCCW95jsWP6lZ3nJW2KKdBf86=
JWN1W59jj9H2CvG6HW8tQ_k22gz0dXW5yCcVz2GnPvKW94Nr3n35ct31W71NSPJ1lmlXSN8szK9=
5X8cJKW65_th38m4kS9W1m5hgv3B55K6W7f0X3Q26CVzDVQ-n1p6M5_ZSW7FxPQX8d8mJ2W4psJ=
Ph7S76_dN2jw10mc7pCfW1B-GJB1fX0wpN7htCcXNBlPJW68s-4J6_gqVSW2nQr-L3mHLmJW6Nl=
pTk8M4VmgW1tG5Sv3GJdQ1W7Yb3sJ4w8ztfVMJ7kC1rBNN1W33BL6q3qlN65N8HfTXt1StggW57=
srfK3WZmgRW2M9DCq5X5v8VW10WKHx54Ytd4W2P3Wn4427f18F71yKHyD64pW6dXKJJ6R1tRVf4=
gJXPM04 )

Fully Patched Version: 2.8.8

Bounty Awarded: $825.00

The "POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notifications a=
nd Best Mail SMTP for WordPress" plugin for WordPress is vulnerable to Stor=
ed Cross-Site Scripting via the =E2=80=98device=E2=80=99 header in all vers=
ions up to, and including, 2.8.7 due to insufficient input sanitization and=
 output escaping. This makes it possible for unauthenticated attackers to i=
nject arbitrary web scripts in pages that will execute whenever a user acce=
sses an injected page.

Technical Analysis #1: Authorization Bypass via type connect-app API

The POST SMTP Mailer plugin helps configure an SMTP mailer in WordPress, re=
placing the default PHP mail function to improve email delivery. In additio=
n, a mobile application can be connected to the plugin using a generated au=
th key. Examining the code reveals that the plugin uses the connect_app() f=
unction in the Post_SMTP_Mobile_Rest_API class to save the mobile applicati=
on connection settings.

[View this code snippet on the blog] (https://email.wordfence.com/e3t/Ctc/G=
C+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZs5m_5PW69t95C6lZ3=
m8W6x_x1J1js2F7W28N_Rg1SSZhBW7NhGZP45_XB4W1Sg4s13JGCkWW4M-Nz62jS65qW8PrYc45=
nC2hTW6Tp81Z6fLxTkW4QP3-m2ygltJW8G64jp99RZxjVhN5L24k8Gr9W7pZPCl7JK95wW361Qh=
63fYmpsW2Gs6nX4wZkmlW1Rhkns8MyHFwW2YB0BC7RfYyZW7KxWPv40V13mW85fH6J1KGnr4W69=
4QNY4-KshhW1Y0dmc5cg2bFW8v1bFH47j6p0W6b_rbZ3wYN3SW4sS1Qz2ZY_HmW8_vjWs3Kn5Lk=
W66G3S775VlQ1W69XjB48TPbwzW8-S1dm3tfq-YW1-0K9s7qNcCmW1MRmxt7G72GhW60NVc44Zm=
W-0W9d4-6g6dMbDZW7Kjv5X7JJL3LN1QQ8WDjfc__W1pczDc3QyG_jW4Kqt4c8gHCxKW636q3C8=
szrFSW1SS2w475swk2f4PKlLg04 )

Knowledge of a randomly generated authentication nonce is required in order=
 to set the value of the FCM token. However, the plugin deletes the auth to=
ken in all cases. This means that after sending the request, the auth nonce=
 is always empty. This made it possible for the attacker to set the FCM tok=
en in the next request, providing a zero value for the auth key which would=
 successfully validate as true.

With the connected application, it is possible to access and view all email=
s, including password reset emails. This can be used for complete site comp=
romise by an attacker triggering a password reset for a site=E2=80=99s admi=
nistrator user, and then obtaining the password reset email through the log=
 data. Once an attacker has access to this key, they can reset the password=
 for that user and log in to the account.

Once an attacker has gained administrative user access to a WordPress site =
they can then manipulate anything on the targeted site as a normal administ=
rator would. This includes the ability to upload plugin and theme files, wh=
ich can be malicious zip files containing backdoors, and modifying posts an=
d pages which can be leveraged to redirect site users to other malicious si=
tes.

Technical Analysis #2: Unauthenticated Stored Cross-Site Scripting via devi=
ce

In the same connect_app() function of the plugin, the mobile application co=
nnection settings include the device value. Examining the code reveals that=
 a sanitization function is missing at the device value input in the connec=
t_app() function, and escaping is also missing at the output in the section=
() function.

[View this code snippet on the blog] (https://email.wordfence.com/e3t/Ctc/G=
C+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZs5m_5PW69t95C6lZ3=
mcW6LKhb53Ys4lJVP0NCk4WTS12W8GWnyb4MVMZkW3RyJVN2S7lwCW94fmPm32-N2tV4-c-G6S-=
y0rW6Jm6bz128rxNW2RsVWM35NRXlW5k5-rK3_Cv5XN5bcJQccfgw3W2F-3RM6mF5tXW5Rvqjd4=
pLKcLW4bsD416VHnw7W8gM8Bd33y4TCW7Z_74s1Z26_mW6v2VRt8S_cSzW5P_LQg81xZgNW8G1p=
x06GZ-KBW874rjv7FKWZTW5GKPtZ2ZmpwbW1Mf1VG4vPGYyW4W0xLm5vln8PW6DJkWv4Vt4YyW5=
RB1MH1gkMlhW5HKPwn5LDfSBW4t19Jr6T4GWwW8FrTCp2mYvqqW1hBx6_4lg1qgW79bTVh4NQJC=
sW8F3T0h7mY6CSW9jKgw05Pb8vPW8pct6g3bsXD-Vt4q-_5wxdhNW3Nh1g_8KB_tGW1lRksX6Z6=
Vp_W5GnnJR5bgGNZf8Sg4b-04 )

This makes it possible for unauthenticated attackers to inject arbitrary we=
b scripts, which will execute whenever an administrator opens the mobile ap=
plication settings page. As with all Cross-Site Scripting vulnerabilities, =
this can be leveraged by an attacker to achieve remote code execution.

Wordfence Firewall

The following graphic illustrates how the Wordfence firewall prevents an at=
tacker from successfully exploiting the authorization bypass vulnerability.

post-smtp-mailer-authorization-bypass-howto-wordfence-firewall (https://ema=
il.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk586=
8yQN6-TNZ85m_5PW5BWr2F6lZ3p-W5cs5_h5ctsvnW3Vf3f-6tcsq5W4b2_fm48ClF1W71PGWS8=
Dh4JFW24hVHX4q3-FXN4TwhXtnw0v8W1SkXc65dlb73W2-zk047nh61WW3b3qJZ2-0kvyW5hxtX=
Z6VLgfFV-wXKs5b4YpsW92v9Zr4pKMm4W5nRm078G73YtMfB07HbglQLN1dqwTTd2fb6W7RV2ch=
5Jt1TkW2j0zkc2zrdDYVxq7PR7kvfwrW5xtcTH1XSnN9W3lV5jH9cPFmcW1ZJc8N5qtLplW6S01=
ZQ5THhHDV9d9FP4WWXm-W1B0ctC1Sgwp3W8NdwnP5ldmxwN68PzTFLFxhSW88Wj0X7lxPLLW2p_=
Dbd2q6hrBW8CbGT799xcL2W8w40v35DJh2DW7ZBQCM72VnD5W2k0-Cq26g12XW4sLNGr7tNdKhW=
79dc9D16zlGQdyNFgx04 )

Disclosure Timeline

December 8, 2023 =E2=80=93 We initiate contact with the plugin vendor askin=
g that they confirm the inbox for handling the discussion for a separate vu=
lnerability in the plugin.

December 14, 2023 =E2=80=93 We receive the submission of the Authorization =
Bypass vulnerability in POST SMTP Mailer via the Wordfence Bug Bounty Progr=
am.

December 15, 2023 =E2=80=93 We validate the report and confirm the proof-of=
-concept exploit.

December 15, 2023 =E2=80=93 We send over the full disclosure details. The v=
endor acknowledges the report and begins working on a fix.

December 19, 2023 =E2=80=93 We receive the submission of the Stored Cross-S=
ite Scripting vulnerability in POST SMTP Mailer via the Wordfence Bug Bount=
y Program.

December 20, 2023 =E2=80=93 We validate the report and confirm the proof-of=
-concept exploit. We send over the full disclosure details for the unauthen=
ticated XSS.

January 1, 2024 =E2=80=93 The fully patched version, 2.8.8, is released.

January 3, 2024 =E2=80=93 Wordfence Premium, Care, and Response users recei=
ve a firewall rule to provide protection against any exploits that may targ=
et this vulnerability.

February 2, 2024 =E2=80=93 Wordfence Free users receive the same protection=
.

Conclusion

In this blog post, we detailed an Authorization Bypass and a Stored Cross-S=
ite Scripting vulnerabilities within the POST SMTP Mailer plugin (https://e=
mail.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5=
868yQN6-TN-23prCCW7lCdLW6lZ3m2W3SdVhP2SZn4-W4Lk06y8N4pHlN1mjxps9d3WFW5RBMhL=
3NZ5-dW4dHLgg7qt3cxW5W-R9l7JyYHkW3RWHsn3zWsclN634fsLZBsYYW3cbMy9698863W49wW=
np5JBg0RW2TDKT08fJzySW7jgLGX1nygtGW6qm6pj2VqlJBW8cGS4n1Hwrh7W6P-4kP7z3jY1Vx=
FVJX5x828XW77RT5D3dvWMmW8yfdfC65j25QN2wwcbDr1MkTW21xlQl6Nf_zsW4zZSpJ7PHztfW=
80fcdr4lNJWKW6WxKBY6yDKlFW7SclhH59G59lf7-fRHC04 )  affecting versions 2.8.7=
 and earlier. The Authorization Bypass vulnerability allows unauthenticated=
 threat actors to reset the API key used to authenticate to the mailer and =
view logs, including password reset emails, resulting in a full site compro=
mise. The Stored Cross-Site Scripting vulnerability allows unauthenticated =
threat actors to inject malicious web scripts into pages. The vulnerabiliti=
es have been fully addressed in version 2.8.8 of the plugin.

We encourage WordPress users to verify that their sites are updated to the =
latest patched version of POST SMTP Mailer.

Wordfence users running Wordfence Premium (https://email.wordfence.com/e3t/=
Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-P=
T6lZ3kZW4sk0Q27M4TT5W1f9TWF82V9n-VnSL5J2g-SsdW3d_frt8NF8tWW4gY0Yz6mLyC8W9bw=
4Zm5WGxXZW2SztVj5zqH45W2gD28_3htxGbW8BJFQv2-v8xTW8vv8wt4q0KWQW3TLGhm8rbFrYW=
9l91bT8TW7pRVqk85R4CyR1gN831hZg110srW6kVX-P7JDHzgV9hF5C4hgmKBW8gGTmQ8g2Qx9W=
7fgsS-8x5NwzW2bcJvY8_jyWPW7LFBH_649fdzW6_Bt5L18JrK5W8m6Bvj2DSd50W5w0Rb21ZKn=
zZW4rqrZn5ngGddW8pJ0MS4rqtxHW96wJ2v13CCj2f71gs2-04 ) , Wordfence Care (http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87=
_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3lHW8gXN2f4CNClnW7bBfbT7HKNScW63x2l493xpBnV=
wqlRT98LSj4W5vt5SP1dr7jRN6DyCRd3Pp_rW4x2wFk2rKC7GVsG88h3mx9Q8W1lbltn1-WwNGN=
6R1PzpS2841W41NHC04Py3bJW4Hv_kX1ymwkwW6NFRmD4ykbSXW7s_gyx86bCjgW3wqqtl4Z_mK=
hW7srPYZ3b3FLHW2dW3hW2g805hW2hmlv02VfZ05W5hzFww4Ky9ZjW5p-K9V2bD9k4N5GW3LZp6=
nLSVC1bV-6Qv3HjW5R22LM1K3ZlLW66_z1P3dqh__W77JP0_1KFYh5W11DHLP1MDyf_f6L3ZgM0=
4 ) , and Wordfence Response (https://email.wordfence.com/e3t/Ctc/GC+113/cw=
G7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3kMW8CSzj=
c1CXpLDW10j4q93qF9yRW94sWNy7Gyq5XW8C_8dP3-Fz9VW2fPd-S4dcL4qW6-zbY71HVXYdVmG=
43G6cWVLrW8z36dK64QcX3W7zM21N5scTc1W8sl8ch7pYMWfW2htW9T4m0MC_W8jhBKJ18xt66W=
7ycM6K1HBWG1W3_nBZH71PQkvW8_MRBW5MjVHFW5_HKXh5x62J2W5XQGbX2TtvzBVh4Hr311sF9=
cN3-W_JTrFzHNW5Px-XQ73SYlhN62rmLwftX_5W95hfmX2GN7pNW5DxCqH5-k6pmW2-yQ2024M4=
hrN8KFdCsHysFvW77PnwX5dg0xkf20mNGl04 )  have been protected against these v=
ulnerabilities as of January 3, 2024. Users still using the free version of=
 Wordfence will receive the same protection on February 2, 2024.

If you know someone who uses this plugin on their site, we recommend sharin=
g this advisory with them to ensure their site remains secure, as this vuln=
erability poses a significant risk.

The Full Product Lineup

wf-stacked-free-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3lGW5WrRK_12btPDW5nw=
vGV7PB-mhVtv4v24xC-4VW7XkhHj5VNCv-W6NFV393snthDW403FVX4QJxdDVrbGq7502hrmW8B=
7C7n3b7pXSW3_TJlC3c89r2N4mL7PxZBNwtW3p6-0B4FnNxYW8Csnqs5Jh7XpW1F9zDH4cB1YtW=
367kHl1klKsnW33qY614VzTb2W5wSDsk3brrPBW3Gx2703lL9gZW2b_Q8C5bn2cLN8XXvfjjgMZ=
0W27YdC12bJM_5W94j9bf7cklHvW5_k0yG7_sY3kW82m88q1x8cgqW8fDw1z74hncYVsDrNj7vb=
75nW8Gvj3Z5KwNzwf1RxT6404 )

wf-stacked-premium-1 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VX=
kzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3lrW247n5Q7xR-5LW=
3hBMlj4ZxynjW68xF6k72dHHdN90hfKWX_5pgW47dXjj8ws9vPW8CTVcv5n49dLW1hP8xP4s8hN=
QW46xXr34YJk6JW22Vpk05G_qj0W4VPy795V_67PW1FS2h78rSxFzN2lFVlHxX1zhW6Jm6GT9dR=
9sMV63zhT7JmZyfW3WFZFJ14dx-ZW8NQ22h2SR6xTV-Hk0m6KNQ-6W91lwNg2lpnTWW2Nn_hT1n=
3-p4W3ssYTj3B3rfdW9j9zrC5_531xW1TJC4k5hn7s9W2RRPfM4vs-20W3HcsPS99H5_BW8xM33=
H40fTmpW94vQVh51X1bxf5fnqld04 )

wf-stacked-care-3 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3nZW2N0NRk3mrNT1W76M=
nfZ4pjyLfW1Bkygd8TWwd_W1d7MGP3hnX0XVqpTlM6Bfm0ZW5vwBVS9kqmd7W1mbt9L3RHtTbW4=
rpj7n70QN6ZW968RzZ8XVw_GW99d2l88kZtNTW4_4D2K3kZQ-rW4jXq343YL6tJW8f-xH64jyYS=
BW4zv_qJ2tYYt1W4q_k028Yw4yPVlcWHh6DF42-W6Qhyh67Lsw1GW7hBq7F4bdBd7W2Q87Rb6gS=
y4VVf8j191B03zgN9ghrcXCkLZ7VLMJjf38DPq7W69swTf1kw--wW25PgdW4p6f4nW6x8jGY1MK=
6NsW1bsTZK2lfs5vf5zVpYs04 )

wf-stacked-response-2 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/V=
XkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3kMW8CSzjc1CXpLD=
W10j4q93qF9yRW94sWNy7Gyq5XW8C_8dP3-Fz9VW2fPd-S4dcL4qW6-zbY71HVXYdVmG43G6cWV=
LrW8z36dK64QcX3W7zM21N5scTc1W8sl8ch7pYMWfW2htW9T4m0MC_W8jhBKJ18xt66W7ycM6K1=
HBWG1W3_nBZH71PQkvW8_MRBW5MjVHFW5_HKXh5x62J2W5XQGbX2TtvzBVh4Hr311sF9cN3-W_J=
TrFzHNW5Px-XQ73SYlhN62rmLwftX_5W95hfmX2GN7pNW5DxCqH5-k6pmW2-yQ2024M4hrN8KFd=
CsHysFvW77PnwX5dg0xkf20mNGl04 )

wf-stacked-cli (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6r=
jWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3prCCW7Y8-PT6lZ3pWW3lF8zd8mTG6gW1cgMq5=
2qRSVSW8bJ9Nh6NfDT9W4y18Px6vj07WW40CMj95TSD9CW1NB64M12v8SdW1TQ4j18R-3DNN8qp=
2x1Lb_KfW6FcWr03M2JghW19ygrX2gsStnN20P1cGxX_nHW6tf6Bg3HvqQ8W5cxbtV29zdGHW30=
2x3G8rfkH1W5Y15VW3XMcRFN14_P044fBkTW5qZnMY22DbDvW7lZ8ZG8BLx9BW2j_PNk3gPxzfW=
2WPL5z3Cc2K6VXd5yh6HGRTQW4bRmCp1r-F19N3KH8C8jtNMbW72Y62b73gsRZW83SXwq9cNsmJ=
W9751hR53xwTyf61h85v04 )

wf-stacked-intelligence (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04=
/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23prCCW7lCdLW6lZ3lYW9dd_NB2TPQ=
_KN7nYDvG-sPDvW8X--945JdLcXW7w6h4d3mxJ57W74VQln45L4glW68zwm98hk_m6W8YvRbS23=
SmLMW3JKTLx35PWF2V64mX08c-rk_W2vQz6M3DmSJlW2VjdcL6c4-YVW5vSHr43W0fbyW73XvZJ=
1RvYnlW1xNY9750wHCyW86KWsm1YSw8kW6JVBN-7swg3nW6GdNn561gkSSW7zY2Tg8sfhclVtGl=
MQ4jgVSGF5KTyVw5ZcMW8H6nZM78slTmW5152VF7PQ8SmVpk_Qp1NjRzfW1hncJb3GC-F0f32Wp=
9K04 )

logo-defiant (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjW=
z0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3prCCW6N1vHY6lZ3lfW1jGs7Z5J-sXQW6HjJjp1Y=
xvh2W3vSG3W55vQY-W90YRlC8c0Lm_W324gVX39jlwkW3BFj9M8XKMswW57FFYb5HwfbGW3zjcN=
X711ZTBW21fC3p5hTy_TVSN1DQ6PB3btW1b2CH34wLV57W5D5Y7s1lr6YjN7HqbjqFqtFpV8kl_=
v8ZXTzmN8Plq29VzM7CVclpjS61CN0YW5wDQmk5GBLhWW6k6Pnt1MFQHDW4BNl5-7fmm02W49w3=
SK26cqhtW7vc6FL4BX4hDW49M65343PJD1f87KdyY04 )

Defiant, Inc., 1700 Westlake Ave N STE 200

Seattle, WA  98109 United States

Unsubscribe (https://email.wordfence.com/hs/manage-preferences/unsubscribe-=
all?languagePreference=3Den&d=3DVnbTNd892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29f=
m6J4V3XVmWFfN7W38cSN8ykQ6g25vC8W7QGvZ-85QFnNVWRWwc5ZdM5-MXk_7Qbw9G5W9k3YN71=
vM-JzVs9-Bt4p-WBQ3jzJ2&v=3D3&_hsenc=3Dp2ANqtz-9WQ5XAcc6srlws2yfkGW2gz5yaAv7=
_rIZ1a4GDrg-GkqMpHByC_ib61vLrMhckxDoUO2aN7TkxTObmWdFsaEQZe-i5og&_hsmi=3D289=
487106 ) Manage Preferences (https://email.wordfence.com/hs/manage-preferen=
ces/unsubscribe?languagePreference=3Den&d=3DVnbTNd892TtnVCnbkg45v0QyW3_X4wv=
3SXQ-tW4h29fm6J4V3XVmWFfN7W38cSN8ykQ6g25vC8W7QGvZ-85QFnNVWRWwc5ZdM5-MXk_7Qb=
w9G5W9k3YN71vM-JzVs9-Bt4p-WBQ3jzJ2&v=3D3&_hsenc=3Dp2ANqtz-9WQ5XAcc6srlws2yf=
kGW2gz5yaAv7_rIZ1a4GDrg-GkqMpHByC_ib61vLrMhckxDoUO2aN7TkxTObmWdFsaEQZe-i5og=
&_hsmi=3D289487106 )

ISO_27001 (https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W=
1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3prCCW6N1vHY6lZ3pRW1zGR9r6LnjdVW24SKKV1p_1q=
cW1CRBsM24ZXdjW3BZ4FG4s3swfW5h9bRZ3NrJsCMPygr7ZJxdJW4jxgx55YDB_KW3bzYhC1BqH=
m-W7pRQLg12j-RGN8Bq7C-HfBkFW6km_V36Rsk25W33M_NN7lsm42N3l0YZV6VmdCW2TW32R6YG=
QrpW3jxS4f2rc2VzW4r0K0H11bbBBW19w5QF81m0VkW4tsc6W11Jg-hW2sg_L12x2KmKW16Qy6x=
55XSR4W50jfnk14x-QZW4FMLqp1526p2f75PRV604 )

You're receiving this email because you signed up for Wordfence's WordPress=
 security mailing list.
------=_Part_25895708_1353425290.1704905846186
Content-Type: text/html; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional //EN" "http://www=
.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns=3D"http://www.w3=
.org/1999/xhtml" xmlns:o=3D"urn:schemas-microsoft-com:office:office" xmlns:=
v=3D"urn:schemas-microsoft-com:vml" lang=3D"en"><head>
    <title>[WordPress Security] Type Juggling Leads to Two Vulnerabilities =
in POST SMTP Mailer WordPress Plugin</title>
    <meta property=3D"og:title" content=3D"[WordPress Security] Type Juggli=
ng Leads to Two Vulnerabilities in POST SMTP Mailer WordPress Plugin">
    <meta name=3D"twitter:title" content=3D"[WordPress Security] Type Juggl=
ing Leads to Two Vulnerabilities in POST SMTP Mailer WordPress Plugin">
   =20
   =20
   =20
<meta name=3D"x-apple-disable-message-reformatting">
<meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3DUTF-8">
<meta http-equiv=3D"X-UA-Compatible" content=3D"IE=3Dedge">
<meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=3D1.=
0">
    <!--[if gte mso 9]>
  <xml>
      <o:OfficeDocumentSettings>
      <o:AllowPNG/>
      <o:PixelsPerInch>96</o:PixelsPerInch>
      </o:OfficeDocumentSettings>
  </xml>
 =20
  <style>
    ul > li {
      text-indent: -1em;
    }
  </style>
<![endif]-->
<!--[if mso]>
<style type=3D"text/css">
 body, td {font-family: Arial, Helvetica, sans-serif;}
 .hse-body-wrapper-table {background-color: #FFFFFF;padding: 20px 0 !import=
ant}
</style>
<![endif]-->
   =20
     =20
   =20
  <meta name=3D"generator" content=3D"HubSpot"><meta property=3D"og:url" co=
ntent=3D"https://email.wordfence.com/-temporary-slug-0909a8bb-d6fd-470f-819=
e-a310c8bdc830"><meta name=3D"robots" content=3D"noindex,follow"><!--[if !(=
(mso)|(IE))]><!-- --><style type=3D"text/css">.moz-text-html .hse-column-co=
ntainer{max-width:600px !important;width:600px !important}
.moz-text-html .hse-column{display:table-cell;vertical-align:top}.moz-text-=
html .hse-section .hse-size-4{max-width:200px !important;width:200px !impor=
tant}
.moz-text-html .hse-section .hse-size-8{max-width:400px !important;width:40=
0px !important}
.moz-text-html .hse-section .hse-size-12{max-width:600px !important;width:6=
00px !important}
@media only screen and (min-width:640px){.hse-column-container{max-width:60=
0px !important;width:600px !important}
.hse-column{display:table-cell;vertical-align:top}.hse-section .hse-size-4{=
max-width:200px !important;width:200px !important}
.hse-section .hse-size-8{max-width:400px !important;width:400px !important}=
.hse-section .hse-size-12{max-width:600px !important;width:600px !important=
}
}@media only screen and (max-width:639px){img.stretch-on-mobile,.hs_rss_ema=
il_entries_table img,.hs-stretch-cta .hs-cta-img{height:auto !important;wid=
th:100% !important}
.display_block_on_small_screens{display:block}.hs_padded{padding-left:20px =
!important;padding-right:20px !important}
}</style><!--<![endif]--><style type=3D"text/css">#hs_body #hs_cos_wrapper_=
main a[x-apple-data-detectors]{color:inherit !important;text-decoration:non=
e !important;font-size:inherit !important;font-family:inherit !important;fo=
nt-weight:inherit !important;line-height:inherit !important}
a{text-decoration:underline}p{margin:0}body{-ms-text-size-adjust:100%;-webk=
it-text-size-adjust:100%;-webkit-font-smoothing:antialiased;moz-osx-font-sm=
oothing:grayscale}</style></head>
  <body id=3D"hs_body" bgcolor=3D"#FFFFFF" style=3D"margin:0 !important; pa=
dding:0 !important; font-family:Arial, sans-serif; font-size:15px; color:#5=
25355; word-break:break-word">
    <div id=3D"preview_text" style=3D"display:none;font-size:1px;color:#FFF=
FFF;line-height:1px;max-height:0px;max-width:0px;opacity:0;overflow:hidden;=
">Critical Vulnerability allows attackers to completely takeover affected s=
ites.</div>
   =20
<!--[if gte mso 9]>
<v:background xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"t">
    <v:fill type=3D"tile" size=3D"100%,100%" color=3D"#ffffff"/>
</v:background>
<![endif]-->
    <div class=3D"hse-body-background" style=3D"background-color:#ffffff" b=
gcolor=3D"#ffffff">
      <table role=3D"presentation" class=3D"hse-body-wrapper-table" cellpad=
ding=3D"0" cellspacing=3D"0" style=3D"border-spacing:0 !important; border-c=
ollapse:collapse; mso-table-lspace:0pt; mso-table-rspace:0pt; margin:0; pad=
ding:0; width:100% !important; min-width:320px !important; height:100% !imp=
ortant" width=3D"100%" height=3D"100%">
        <tbody><tr>
          <td class=3D"hse-body-wrapper-td" valign=3D"top" style=3D"border-=
collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-se=
rif; font-size:15px; color:#525355; word-break:break-word">
            <div id=3D"hs_cos_wrapper_main" class=3D"hs_cos_wrapper hs_cos_=
wrapper_widget hs_cos_wrapper_type_dnd_area" style=3D"color: inherit; font-=
size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" d=
ata-hs-cos-type=3D"dnd_area">  <div id=3D"section-0" class=3D"hse-section h=
se-section-first" style=3D"padding-left:10px; padding-right:10px; padding-t=
op:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border hse-border-top" style=
=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto; =
border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1; =
border-right:0px solid #008cc1; box-sizing:border-box; border-top:0px solid=
 #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1;border-top:0px solid #008CC1" cellpadding=3D"0=
" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border hse-border-to=
p" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-0-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-0-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3qgyTW6N1vHY6lZ3mlW3-ZyxH2hJKzBW8cG=
sCk3cPSLGW4q6zst3ptD93W2h99Yg26nrM9W7VlPP8434CFMN9bWFLHFFwG4W2zQzZY3bR_2BW5=
2Xr823jL3GBW3BYj4s1Mk_MjN5qv5ZtFYZ9KW4nSsx72QytzsW85rjGk3_-NdvW3yY7z35_p3Kx=
W9d520m6v3fy7W8sR-XP843FHBW35Kr3V99T0csW2-pr_Q6YPp5xW2PgRF-2ZHD-0W2TYCp061T=
1gQW3sLjdr3BWL63W6g7L114T_Z38W6-DZ1h3B5BYKf2bKWLq04" target=3D"_blank" styl=
e=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"Wordfence-Logo.png" src=3D"https://email.wordfence.com/=
hs-fs/hubfs/Logos/Wordfence-Logo.png.png?width=3D600&amp;upscale=3Dtrue&amp=
;name=3DWordfence-Logo.png.png" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"300" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D600&amp;u=
pscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 300w, https://email.wordfen=
ce.com/hs-fs/hubfs/Logos/Wordfence-Logo.png.png?upscale=3Dtrue&amp;width=3D=
1200&amp;upscale=3Dtrue&amp;name=3DWordfence-Logo.png.png 600w" sizes=3D"(m=
ax-width: 300px) 100vw, 300px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-1" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-1-0" class=3D"hse-column hse-size-12">
  <div id=3D"hs_cos_wrapper_module-1-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZ85nR32W5BWr2F6lZ3l9W248PzL9k2WkYW3qx=
zCB3-X4vSW4TGByC1N6lpFW107jY2124RtkVXP8Bv97sQsCW195B1P5Lj0BmW1XLFTl7vCrMxW4=
bdXLF21NnL_W8tNyvG3c4dx4N5n00bHvjrsPV3bjzC3TDDD2W1gHH-P75cdbJW574Kj52Cw5QBN=
2v43TMB1fstW3Hrx8_1N3TjLW1sZ5YL6qz0ZbW7sLBgg4QL7JnW798QQB8HrfXpW6sv1xj2TVhx=
GW7T4VTz5MYQqZW7DLjtw8JtZq2W4nb0Jg4f_cS6W4wMD4Z3jXwh1W1gFJRN4XcGGkW8BtpSM2T=
L8_-W3L1_gG5FS8-DW1YzPv-19gqdsN5h06VM9k0N7W1MjwXC6L4QJGW4znX8Y6bvFLLW45R2fz=
408wVDW5N7mcZ8Y59X2Vy7y2D6nRvCTW8rwgYb5qqnkSf1lT2nW04" target=3D"_blank" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"FeaturedImage_Wordfence_71.02" src=3D"https://email.wor=
dfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_71.02.png?width=3D1120&amp;u=
pscale=3Dtrue&amp;name=3DFeaturedImage_Wordfence_71.02.png" style=3D"outlin=
e:none; text-decoration:none; -ms-interpolation-mode:bicubic; border:none; =
max-width:100%; font-size:16px" width=3D"560" align=3D"middle" srcset=3D"ht=
tps://email.wordfence.com/hs-fs/hubfs/FeaturedImage_Wordfence_71.02.png?ups=
cale=3Dtrue&amp;width=3D1120&amp;upscale=3Dtrue&amp;name=3DFeaturedImage_Wo=
rdfence_71.02.png 560w, https://email.wordfence.com/hs-fs/hubfs/FeaturedIma=
ge_Wordfence_71.02.png?upscale=3Dtrue&amp;width=3D2240&amp;upscale=3Dtrue&a=
mp;name=3DFeaturedImage_Wordfence_71.02.png 1120w" sizes=3D"(max-width: 560=
px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-2" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-2-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023190359051" class=
=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=
=3D"color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-=
general-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapp=
er_module_17023190359051_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs=
_cos_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; l=
ine-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=
=3D"rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">=
On December 14th, 2023, during our Bug Bounty Program Holiday Bug Extravaga=
nza, we received a submission for an Authorization Bypass vulnerability in&=
nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6r=
jWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23qgyTW7lCdLW6lZ3m-N6n8n0vrcLvQW87dhZd4=
V28GlW6Rv6TT7w_tfDW5-JQz64ZvcKDV8WQB584Lc3zW1fSZFm5SkBghW4zTRfv2WH9jYW9cqTh=
j3k1dy3W7Mrg818qVFcMW24BJCL2_DFTcW3KJ9mH8hbs7RW5gw6P-5XrmTRW1sv5Fq78MQD6W5F=
jhN43B_Gj0W4B2gnv7CWJHQW6w_Ry98YjgJ5W2SNxf91Hnh60W2ZkpkR8nVL1VW42TBBy9cnFdB=
W28tWr36qTMkkVfTLjq3wk8xPW8hyt7F6Rtr6KW6zvpWm7kwFr3N1_658SCRMyCf6-TwM-04" t=
arget=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-r=
ule:exactly" data-hs-link-id=3D"0">POST SMTP Mailer</a>, a WordPress plugin=
 with over 300,000+ active installations. This vulnerability makes it possi=
ble for unauthenticated threat actors to reset the API key used to authenti=
cate to the mailer and view logs, including password reset emails on WordPr=
ess sites that use this plugin. We also received another submission shortly=
 after for an Unauthenticated Stored Cross-Site Scripting vulnerability in =
POST SMTP Mailer plugin from another researcher. This vulnerability enables=
 threat actors to inject malicious web scripts into pages.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><em>Special pro=
ps to&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VX=
kzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3qgyTW95jsWP6lZ3p8W2_kfW15FfYKYL=
3v0NgJfgpW80fL4n4WK6byVrgy283Qrb92W3fp7wf8W7gW_W65hXBQ3cSLvFN6kW4_ZSfffcVg3=
tnd2CTb9YW47D0XB55Jg37W5Ylxgj5RrYqPW3X8KJb7_WBV6W17F53l8H1tBLW5Wckjl4pml-3V=
C4C7q53Cy4_W1pYYTQ1_9b25VKnQlp38VX7lW5gsS1Z87GdgqW6B2PJj1ds28-W3RJK-T1BNFTQ=
W6PjlzG5xWm2nN2S2ggfLD0fLW2NVk9F3-js-0W1vsXtc5_6jsDW4pSKH34H-LJVN6MhHFsdLgV=
3W8d3CWf7MNt-3W1yj1ld6424sDN2LqPBWh-fXHVTvdKW83GLd_W4NK4mT50mM6SdntPJY04" t=
arget=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-r=
ule:exactly" data-hs-link-id=3D"0">Ulyses Saicha</a>&nbsp;and&nbsp;<a href=
=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72=
FY8hkW87_Sgk5868yQN6-TN-Y3qgyTW95jsWP6lZ3msW2BfDsw1qjjD4W2hH9tm2qtbrGW7FrzL=
N7zNwSJW2_dCrW9jWm3GW1C2ClN6wF2VXW7jf8gB8BLC4BVdXmg98tyMRTW81mVBj8Zp0TrW3S4=
1bM7Zt-kLW3m90V35qPVq6W76JmXt7TlpGPN8NGVHB_j12qW67yY7x8QGYNRW1gqqPN8sPzmgW3=
Bbqfs8rmM_YW6wgQC079gGkNW17Sr2x5W3t2tW6Mc7rw5r2JT0V7tdnb7VKXgFV9TgWW5R5DqDW=
2VfrYm4wDZCqW1HqYFN35gkrdN6bjyck7XnVqW64fN_N3D2xgFW4l-w7G9dxbD2W3Ycwkt6SPYG=
wW7f8sZm31MBk7W64hPS-1_FFn7W1NnsWQ7vF5bFW1Y9X8W1FV9sRf7wM-pY04" target=3D"_=
blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-height-rule:exactl=
y" data-hs-link-id=3D"0">Sean Murphy</a>, who discovered and responsibly re=
ported these vulnerabilities through the Wordfence&nbsp;<a href=3D"https://=
email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk=
5868yQN6-TN-F3qgyTW8wLKSR6lZ3mtW412FJ07FcnXnW6xnTG22YM4_hVMrPxn6lj66WN8-ntQ=
mkxrSmW58Y6-S2tKbPkW5jX2W11twh9YW9dHFRR2LPxXRW2SJk831j21t4W82zQzq2n_jY1W4Vn=
wFn9gqVSYVJ8qBn3rj6ZdW6k4dYW74sLNnW75FcLn5Q2WQSW2sTvcL7nCHj5VDyv1-1dsD-yW39=
ZP_27lh7ZXN90S6MGp-lv0W97PKJ539FDsVW2m0ZyT41BtWHN8spWTMpqc3bW7M71vK5J_24fW1=
V1Lzz1Lq_LBW3pFjmT89JwYHW5s49n999_2cpW6pHKMP7bl1c-W6dpXXg49fBLLW2vcRQZ1ZlYG=
QV11K8W76pLqRf7NqpY004" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-h=
eight-rule:exactly" data-hs-link-id=3D"0" target=3D"_blank">Bug Bounty Prog=
ram</a>. These researchers respectively earned bounties of $4,125 and $825 =
for their discoveries during our Bug Bounty Program Extravaganza.</em></p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><a href=3D"http=
s://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87=
_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3kBW2vT49W3q1qynW4NPMNP8LwXLZW1H6WB91YH6fQW=
4XgQ1B5hqPVvW7xc9xX68lCxsN36Px0-kZtbqW2j1Vwc6xy3RPVT_j2C5Tg5byW79yrfm137vFs=
W1b5_yW3vwZr6W2JCS-B6Lc5cRW2n5xmF7B0YhQW344g3B4bdwKtW3mGDGS7x5XfDW4DFYqG6t8=
FdQW8syY7G25l369W3zDXy22B2BbNMjvknVHLPw6W4FrSWq8SWqZrW7Hhjc-39C483W2cmxCD8N=
D5bjW2GdFlj7S40slW67rfhc4Whz59VSY_Fs79f7_RW6nGD_C96NG-dW3sT3s52KJMl2f8bMDBY=
04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-hei=
ght-rule:exactly" data-hs-link-id=3D"0">Wordfence Premium</a>,&nbsp;<a href=
=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72=
FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3mlW66jqyG4XQ9PgW4GLdsv69z1r5W19GVT=
z5kwY8nW2CPd7D7cT5bYW4dztZl5sTynzW6Szxhp3kNd-7W7cbZfJ78QtxGVJK6sg5706rMW7-c=
f952P3PxcVZ_Yn94Q1ftZW43T6BN3w1gwBW2SPhwH7g9bcfW45jjJm7f-3j1W2H_BsB47sfS3W3=
P7fxH2sKhKGW1GJS5l2DScnmW5BKcTN2myGR2W4vb6T_7dtlH5W6TDFXb3zdrS0W4QwvZ9632f2=
MN7cbsjlqq317W8lz6VF1NgXLWW6z73NM2_kygtW6Myl423sbv3DW4Mf7T49dLmmYW2-SCS_1fY=
bZBf591gPH04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; ms=
o-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Care</a>, and&n=
bsp;<a  href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6r=
jWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3lnW4l3CZn8QWhvSW18WYvj=
4PXsXXW5Qq8gq94ybJWW32Nb3M19BWpGW7SjNGc6GNKhNN45QGxr3PYhsW56Q9ZD79_SXHW2C1F=
ZL9dRxCBW9jW8Vw1mXcyTW8KXrZH1K9D9wN4W4wFF745xzW6lH4Xt3rq3NQW4BFSPz7ws6JNW30=
R_yh220ZxrW6ShtG466J94_VTgbqg14VCllW3GBwTT793Cs8W3hsdW11jtgypN4c6Q18xm1XFW3=
f7ztk4Q0Pz4W4WQL594Tbl5NMNV66D6CMk6W8g56XG6JLPrsN2YCGDYXk8mrW8lB4WH4d2PYvW6=
FVL-t6F4G6mf2rLH0s04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00=
a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">Wordfence Respons=
e</a>&nbsp;users received a firewall rule to protect against any exploits t=
argeting these vulnerabilities on January 3, 2024. Sites still using the fr=
ee version of Wordfence will receive the same protection on February 2, 202=
4.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">We contacted WP=
Experts.io on December 8, 2023 for a separate vulnerability, and received a=
 response on December 10, 2023. After providing full disclosure details, th=
e developer released a patch on January 1, 2024. We would like to commend t=
he WPExperts.io team for their prompt response and timely patch.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">We urge users t=
o update their sites with the latest patched version of POST SMTP Mailer, v=
ersion 2.8.8 at the time of this writing, as soon as possible.</p></div></d=
iv></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_16971242493161" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module">
 =20
  <table align=3D"center" border=3D"0" cellpadding=3D"0" cellspacing=3D"0" =
role=3D"presentation" style=3D"border-spacing:0 !important; mso-table-lspac=
e:0pt; mso-table-rspace:0pt; border-collapse:separate!important">
    <tbody><tr>
        <!--[if mso]>
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" valign=3D"=
middle" style=3D"border-radius:8px;cursor:auto;background-color:#00709E;pad=
ding:12px 18px;">
    <![endif]-->
    <!--[if !mso]><!-- -->
      <td align=3D"center" valign=3D"middle" bgcolor=3D"#00709E" style=3D"b=
order-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, s=
ans-serif; font-size:15px; color:#525355; word-break:break-word; border-rad=
ius:8px; cursor:auto; background-color:#00709E">
   <!--<![endif]-->
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZ85nR32W5BWr2F6lZ3nSW3hq3-P83T7M3W4mw=
4Tx4qB2mXW2xc5Vw2QdXpXVq8rzQ7w8v3vW4dR-b12_VDsyW76NhRQ6YvbK9W7RnW7-1jrSdcW3=
9YHWD10chBFW7yfMqg1B5Gn-W5-TCK02N9SMPW2hHZw27ggY6JW2X1fC84p-rm8W1TX_TP7D2zf=
-W4v3GQC1ZXhPGW9k9jsQ7LzlrzW2mW7k27dKH2bW56RcnB4RbZwdW4jjdqF5hnSPZW2pnCwc5v=
_n7bW64ysR_8_q2_SVK_3_J1kmfhjW5bq9-K6DBHMtW5gmWmC3-9TJlW1j7SBc4WMQk5VMmYM-3=
WwpLxW7VTrQm8Q2Zk0V2rKvK4bCzb2W7S9vdX5SzP6BW4VHtcS911mm3W3Q_pR16_LSSfVhTllm=
1FLMqFN8gp6vSNrhSSW4dkRsJ97qjJHW337y_W3JhND_f55w1fK04" target=3D"_blank" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly; font-size:16px; font-fa=
mily:arial, helvetica, sans-serif; Margin:0; text-transform:none; text-deco=
ration:none; padding:12px 18px; display:block" data-hs-link-id=3D"1">
          <strong style=3D"color:#ffffff;font-weight:normal;text-decoration=
:none;font-style:normal;">CONTINUE READING ON THE BLOG</strong>
        </a>
      </td>
    </tr>
  </tbody></table>
</div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-3" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-3-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module_17023191351374" class=
=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=
=3D"color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-=
general-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapp=
er_module_17023191351374_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs=
_cos_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; l=
ine-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=
=3D"rich_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-he=
ight:175%; font-size:22px">Vulnerability Summary from Wordfence Intelligenc=
e</h2></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17049035078011" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div style=3D"padding: 6px; =
margin-bottom: 1em; background-color: #f2f2f2; line-height: 1.4;"><b>Descri=
ption:</b> <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VX=
kzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNYT7mmzdW50l5tj6lZ3ltW25QxrW8xK9qdV=
Z8-YH3Q2VCwW5Tp3fB5Nzx2jW5fl_4r90bfF0W8kRw3S30HxmkW5Kv8f61zMpxdW37ctxH778Yh=
5W91CM7756c-c9W60BlYV2khTg5VBHGDr5JWz_LW4XDyCk9cxgyqW2Gtbgb6rM_g7N8Crm5Dxhn=
YbW95ZwkD60jH05N7n4pd0BzrvNW23d0qg64kQP1W6z0Cvh4Z2BywW3K6jkH8HWKM1N2YdYmFSk=
1TMW6GBKqx8ZpdWSW394TvX7pkbkfN1tc6YQ2HzTjW4PYW6_7SYw8-VvyWFX86yczGW5XRnDR7-=
gT0-Vs25H35g44PWN2Xwxs8X-XtcW3ZfCDD808jm7W31yHLy6qfGKHW39kY0v3WnJJkW2r47n65=
2JhDGMxb6g68vxMlW9jdR954ZQjtFW677dBM5vBV9fW5f90fQ6YkWr6W5kHsLR1BMYvyW6z99Zr=
1tBzn_W3CrBzH7rPRXJVzzlfj3zd4-jW4myLXK7ybCWtW8HV6pp1ScBj-W1ltTCL7GGlXLW8p-f=
3c8kZqn3W222Bw74_3YDyV4YD872HbD8cW4BlqlF4MwF9mW6YNHxp2TT42lW8kVzYp3H631SdLw=
Dy604" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-line-=
height-rule:exactly" data-hs-link-id=3D"0">POST SMTP Mailer =E2=80=93 Email=
 log, Delivery Failure Notifications and Best Mail SMTP for WordPress &lt;=
=3D 2.8.7 =E2=80=93 Authorization Bypass via type connect-app API</a><br>
<b>Affected Plugin:</b> POST SMTP Mailer =E2=80=93 Email log, Delivery Fail=
ure Notifications and Best Mail SMTP for WordPress<br>
<b>Plugin Slug:</b> post-smtp<br>
<b>Affected Versions:</b> &lt;=3D 2.8.7<br>
<b>CVE ID:</b> CVE-2023-6875<br>
<b>CVSS Score:</b> 9.8 (Critical)<br>
<b>CVSS Vector:</b> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H<br>
<b>Researcher/s:</b> <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/=
cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3qgyTW95jsWP6lZ3mrV9MT=
LX4-66FxVK-QMc9lfkVgW1zpb3C1d0XtJVb8NKh3m4ywtW6b-vfB4q8kp_W7l65Yy33CvLDN6L8=
7TQHRrtbN37r1hfZ8Y79N7HVyPkH52TgW4C37m78G9y8TW6WBVDR5PHT-kW8jLq_8454SlyW8GD=
q1n53DhLDW5_2pNy5FkcsZN39WtPYc1dGFW2HJg5Z6FPFy1W1b79zt9bTn1HVmWgr97N602-N3m=
r2MR8q41-W5q1TBM6sH77_W1qGTrw3BBWfDW7t3Gt78bTTZRW7j727578p3wDVFjbKp5P5N31W2=
gjV7x4Xg0gxW7B5jyl8fJ_ZbW3MqNv41ztVB-W1FdGXT5wQmjJW6f_fZb4fWkzmW7cgtVY6L-J3=
Xf2CMj5Y04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso-=
line-height-rule:exactly" data-hs-link-id=3D"1">Ulyses Saicha</a><br>
<b>Fully Patched Version:</b> 2.8.8<br>
<b>Bounty Awarded:</b> $4,125.00</div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17049035797382" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17049035797382_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The "P=
OST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notifications and Bes=
t Mail SMTP for WordPress" plugin for WordPress is vulnerable to unauthoriz=
ed access of data and modification of data due to a type juggling issue on =
the connect-app REST endpoint in all versions up to, and including, 2.8.7. =
This makes it possible for unauthenticated attackers to reset the API key u=
sed to authenticate to the mailer and view logs, including password reset e=
mails, allowing site takeover.</p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17049035982553" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div style=3D"padding: 6px; =
margin-bottom: 1em; background-color: #f2f2f2; line-height: 1.4;"><b>Descri=
ption:</b> <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VX=
kzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNYT7mmzdW50l5tj6lZ3pMW7Rdn4V12f46MW=
3tVkQT48TbxQW826lJ46Djpw1W7K1xGC6F9NyVW76Nlmq1HVJQ9W4tQYPN56NL4dW4MXjC78gYz=
J0N6jzbwZGFpTSW2WJBP23pYp-wW17Gqsb1484p6W3jxJz82rW8kvW7QpWTF90D9kkW685KKh8L=
tk6TVmYdD-7KlvP9VzQZ0r3n2ZDXW5NypLy5Mt0cxN3zVHvH66kn-W1f7tjh3f4ZCSW63Bk2L82=
-nqgW93dJbl4MZkkCVFR1LN6WrsVjW7DzFhL5zhYqFW765HDW79kLSyW8f_NpQ2-wYjjW8NHz_2=
88VfmZV4jMMk2PCtHZW5yKSc28MCg4DW1KRrlv6MRKTHW4tnf7V4bk03JW8Ph0gN3Nh165W2kjJ=
sK5ffFxxW5C3wmt4p0hp0W4SGsrj16XbvsW7mLw9W6GQ16SW8NrLtN5tB6sqW4Xz97c5x1w6-W7=
0nf8Y4DVGyNW5D0sD-8HGCX-W4mB8pR76jgDvW57R_z_9bwsW-W7KDzqJ8LqdtYW93ysqB4L_g1=
GW5wPXmd4JV54NW2G0fx992yGSBW8dLWYX2NBJNVW2Nw0DL6lb6l9V2fscG7LC4JyVbrVtz3-hX=
n_f8YK2Sb04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; mso=
-line-height-rule:exactly" data-hs-link-id=3D"0">POST SMTP Mailer =E2=80=93=
 Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress=
 &lt;=3D 2.8.7 =E2=80=93 Unauthenticated Stored Cross-Site Scripting via de=
vice</a><br>
<b>Affected Plugin:</b> POST SMTP Mailer =E2=80=93 Email log, Delivery Fail=
ure Notifications and Best Mail SMTP for WordPress<br>
<b>Plugin Slug:</b> post-smtp<br>
<b>Affected Versions:</b> &lt;=3D 2.8.7<br>
<b>CVE ID:</b> CVE-2023-7027<br>
<b>CVSS Score:</b> 7.2 (High)<br>
<b>CVSS Vector:</b> CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N<br>
<b>Researcher/s:</b> <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/=
cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-Y3qgyTW95jsWP6lZ3lXW5w1=
ZZ94n-MQ3W4c-T3b75XsB3W97QH3j8-6X8NW8bDZ1m1F6Gt2W4hW_Z-7jfBs_N71Yt9Y-_GBNW2=
597s12DtqFLW1BppqM7gnwmQN1pZRrLZwmntVZQWjk1nFWGlVqgXBC5RDQ_SW5sGjZP8hlR46W1=
H2cHD7S0Gy9W44kLJX4NjvWKW4l5dtr63S_yPW5w11tY5q7HwgW1vzfJD6HR6yLN9d1zZv2lV1Q=
W2JlxVj97d5zMW2wDkBG82jdwVN5k7GqmZvG9bW55gjJx70tXbWW3Yv9vm85QZ83W6_Zz7m1lJN=
jgW4wPhZC41gyyGW71JkKQ6z-803W8Yhj3L3ZTq_kW8yDjrv23kvn6W7Y5gJ455NKtMW7x4g871=
dbqjLf6WpgWW04" target=3D"_blank" rel=3D"noopener" style=3D"color:#00a4bd; =
mso-line-height-rule:exactly" data-hs-link-id=3D"1">Sean Murphy</a><br>
<b>Fully Patched Version:</b> 2.8.8<br>
<b>Bounty Awarded:</b> $825.00</div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_170240303037319" class=3D=
"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"=
color: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gene=
ral-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_m=
odule_170240303037319_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_co=
s_wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line=
-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"=
rich_text"><p style=3D"mso-line-height-rule:exactly; line-height:175%">The =
"POST SMTP Mailer =E2=80=93 Email log, Delivery Failure Notifications and B=
est Mail SMTP for WordPress" plugin for WordPress is vulnerable to Stored C=
ross-Site Scripting via the =E2=80=98device=E2=80=99 header in all versions=
 up to, and including, 2.8.7 due to insufficient input sanitization and out=
put escaping. This makes it possible for unauthenticated attackers to injec=
t arbitrary web scripts in pages that will execute whenever a user accesses=
 an injected page.</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">&nbsp;</h2>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Technical Analysis #1: Authorization Bypass via type connect-ap=
p API</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The POST SMTP M=
ailer plugin helps configure an SMTP mailer in WordPress, replacing the def=
ault PHP mail function to improve email delivery. In addition, a mobile app=
lication can be connected to the plugin using a generated auth key. Examini=
ng the code reveals that the plugin uses the&nbsp;<span style=3D"font-famil=
y: 'Courier New', Courier, monospace;">connect_app</span>()&nbsp;function i=
n the&nbsp;<span style=3D"font-family: 'Courier New', Courier, monospace;">=
Post_SMTP_Mobile_Rest_API</span>&nbsp;class to save the mobile application =
connection settings.</p>
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</div>
<div style=3D"mso-line-height-rule:exactly; line-height:175%"><a href=3D"ht=
tps://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW=
87_Sgk5868yQN6-TNZs5nR32W69t95C6lZ3nHW3btLyp3r9WwlW92pRsd60TY0LW2lcBWy3Llxp=
lW1xVzP36xwKHdW29n5hZ6Pz9pmN5SZNhBlF2TFW2dNMnS6g9gm-W5cWfVJ1H1wwPW7300YJ63H=
R_SW4dZ9lK1n4WqVW2p7q4g1lyYDnW1CR5yr56gvkzW66zXMw2LtQMKN4Zr_ztxfFrFW7HfH-L2=
PcytFW4frWxX14k8hTW5R56YG3-N-g8W4W3Jg32GZ24tW2Vqy177YYvC4W3NvKmW1Ng4czW4nDr=
my6n46FrW5H7mMX5jf1XrW99Lzj77McB9qW4CwNqx7cn2WdW7pYD--7tV1wCW8-jQrq2BXlvHW7=
9SmLw3l6Z8YW40GvJ-2HGCYFW8nHbLW3kfGK2W8fh82_809j61W1kMjpF5vln60VBB5yS3CDxQ9=
W86BrhJ13rb9CW6m5PzV5FTwh4W4x8WZg7hzHhyVMfkLs7T9nwhd3w_7v04" rel=3D"noopene=
r" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D=
"0" target=3D"_blank">[View this code snippet on the blog]</a></div>
<div style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</div>
</div>
</div>
</div>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Knowledge of a =
randomly generated authentication nonce is required in order to set the val=
ue of the FCM token. However, the plugin deletes the auth token in all case=
s. This means that after sending the request, the auth nonce is always empt=
y. This made it possible for the attacker to set the FCM token in the next =
request, providing a zero value for the auth key which would successfully v=
alidate as true.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">With the connec=
ted application, it is possible to access and view all emails, including pa=
ssword reset emails. This can be used for complete site compromise by an at=
tacker triggering a password reset for a site=E2=80=99s administrator user,=
 and then obtaining the password reset email through the log data. Once an =
attacker has access to this key, they can reset the password for that user =
and log in to the account.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Once an attacke=
r has gained administrative user access to a WordPress site they can then m=
anipulate anything on the targeted site as a normal administrator would. Th=
is includes the ability to upload plugin and theme files, which can be mali=
cious zip files containing backdoors, and modifying posts and pages which c=
an be leveraged to redirect site users to other malicious sites.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Technical Analysis #2: Unauthenticated Stored Cross-Site Script=
ing via device</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">In the same&nbs=
p;<span style=3D"font-family: 'Courier New', Courier, monospace;">connect_a=
pp</span>()&nbsp;function of the plugin, the mobile application connection =
settings include the device value. Examining the code reveals that a saniti=
zation function is missing at the device value input in the&nbsp;<span styl=
e=3D"font-family: 'Courier New', Courier, monospace;">connect_app</span>()&=
nbsp;function, and escaping is also missing at the output in the&nbsp;<span=
 style=3D"font-family: 'Courier New', Courier, monospace;">section</span>()=
&nbsp;function.</p>
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">
<div style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</div>
<div style=3D"mso-line-height-rule:exactly; line-height:175%"><a href=3D"ht=
tps://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW=
87_Sgk5868yQN6-TNZs5nR32W69t95C6lZ3lHW3W5B1L4GZW7KW1QgRhK3rs2h9W8-smnV6gdZm=
cW5NSvw88N5BryW8KKGFS5dvzkJW6kDPrS2HhKbMW6Pnm7m5MPNxVW2CWNCF5QKgL0W90wJ187c=
l56sVtXG2m1FrlfXW85r8Gg45DWqyW7wF4663JpkhjVHzjn339LN8qW6GpSc42Xbxc8N3YLX5gc=
j5krW6dWrsC6sx67QN6XPB_wc1zp8W7vBYFK6KXjs1N8p6nbH-6rwjW8s4f_G90xLYdW94Ks7X6=
-VsXWW80WqTN3mj3JkW5TZ-tY8gt_M-W8b-6gg9lbMPSW8Qp-LS48q8F8W3rqN7Q52pSf0W387x=
Sr4KwVbfW2GW9MZ5hQq-LW1_nvbk15dlTxN5fx-s25PPDPW7myXpx57jgn6W5lVpQR3LkBDFW2G=
CPr03hGnq-W3GHmXB3CZT4-W4_2JNw5knxzDW6DSnG317dCspf8vygKR04" rel=3D"noopener=
" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"=
0" target=3D"_blank">[View this code snippet on the blog]</a></div>
</div>
</div>
</div>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">This makes it p=
ossible for unauthenticated attackers to inject arbitrary web scripts, whic=
h will execute whenever an administrator opens the mobile application setti=
ngs page. As with all Cross-Site Scripting vulnerabilities, this can be lev=
eraged by an attacker to achieve remote code execution.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Wordfence Firewall</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">The following g=
raphic illustrates how the Wordfence firewall prevents an attacker from suc=
cessfully exploiting the authorization bypass vulnerability.</p></div></div=
></td></tr></tbody></table>
<div id=3D"hs_cos_wrapper_module_17049036917824" class=3D"hs_cos_wrapper hs=
_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; fo=
nt-size: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget=
" data-hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"pr=
esentation" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"bor=
der-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; m=
so-table-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZ85nR32W5BWr2F6lZ3pMW7Bdgxd68dgc9W20X=
7jK6sGQ2xW127f8t6090HnW6WfxRw17K-m8W68rKqX7hRNLRW3pWRJJ48cFYtW7zCh3B1g-vvdW=
4R5LCN57lFn3W37Ljlt8fhPq1W6h_3K97G49x4W48yswj2x97gbW9lh8Sb2CyqB0W5951Vd5YD1=
3yW7yHjxT38MPXqW30_xcW8zP3lhW8G1RZp8mXNRsW15YyfQ8SjS-BW5PMLWq55t9pcW1n34FG7=
VnrhRW4h3CxB8Whv95W8pbwKL6r6g-9W2bPXR01gYHvlW5hDTPH6QmnRsW5jnlLJ5vWCqyN60bc=
zjcW_-pVfjXzM5LmQHvW7Btrhm5K2Bm9W47dgXc7QCwZ6W2D9cWW8vmMKmW2K1x0m4tk6FxVXYQ=
QQ3ZYk-3W6TmY6T5krCQlW2zFhSm2s6Df4V9ZvhZ8QY_9Ndmn09b04" target=3D"_blank" s=
tyle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"2">
        <img alt=3D"post-smtp-mailer-authorization-bypass-howto-wordfence-f=
irewall" src=3D"https://email.wordfence.com/hs-fs/hubfs/post-smtp-mailer-au=
thorization-bypass-howto-wordfence-firewall.png?width=3D1120&amp;upscale=3D=
true&amp;name=3Dpost-smtp-mailer-authorization-bypass-howto-wordfence-firew=
all.png" style=3D"outline:none; text-decoration:none; -ms-interpolation-mod=
e:bicubic; border:none; max-width:100%; font-size:16px" width=3D"560" align=
=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/post-smtp-mai=
ler-authorization-bypass-howto-wordfence-firewall.png?upscale=3Dtrue&amp;wi=
dth=3D1120&amp;upscale=3Dtrue&amp;name=3Dpost-smtp-mailer-authorization-byp=
ass-howto-wordfence-firewall.png 560w, https://email.wordfence.com/hs-fs/hu=
bfs/post-smtp-mailer-authorization-bypass-howto-wordfence-firewall.png?upsc=
ale=3Dtrue&amp;width=3D2240&amp;upscale=3Dtrue&amp;name=3Dpost-smtp-mailer-=
authorization-bypass-howto-wordfence-firewall.png 1120w" sizes=3D"(max-widt=
h: 560px) 100vw, 560px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:10px 20px"><div id=3D"hs_cos_wrapper_module_17049036958295" class=3D"=
hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"c=
olor: inherit; font-size: inherit; line-height: inherit;" data-hs-cos-gener=
al-type=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_mo=
dule_17049036958295_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_=
wrapper_type_rich_text" style=3D"color: inherit; font-size: inherit; line-h=
eight: inherit;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"ri=
ch_text"><h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:1=
75%; font-size:22px">Disclosure Timeline</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%"><strong>Decembe=
r 8, 2023</strong>&nbsp;=E2=80=93 We initiate contact with the plugin vendo=
r asking that they confirm the inbox for handling the discussion for a sepa=
rate vulnerability in the plugin.<br><strong>December 14, 2023</strong>&nbs=
p;=E2=80=93 We receive the submission of the Authorization Bypass vulnerabi=
lity in POST SMTP Mailer via the Wordfence Bug Bounty Program.<br><strong>D=
ecember 15, 2023</strong>&nbsp;=E2=80=93 We validate the report and confirm=
 the proof-of-concept exploit.<br><strong>December 15, 2023</strong>&nbsp;=
=E2=80=93 We send over the full disclosure details. The vendor acknowledges=
 the report and begins working on a fix.<br><strong>December 19, 2023</stro=
ng>&nbsp;=E2=80=93 We receive the submission of the Stored Cross-Site Scrip=
ting vulnerability in POST SMTP Mailer via the Wordfence Bug Bounty Program=
.<br><strong>December 20, 2023</strong>&nbsp;=E2=80=93 We validate the repo=
rt and confirm the proof-of-concept exploit. We send over the full disclosu=
re details for the unauthenticated XSS.<br><strong>January 1, 2024</strong>=
&nbsp;=E2=80=93 The fully patched version, 2.8.8, is released.<br><strong>J=
anuary 3, 2024</strong>&nbsp;=E2=80=93 Wordfence Premium, Care, and Respons=
e users receive a firewall rule to provide protection against any exploits =
that may target this vulnerability.<br><strong>February 2, 2024</strong>&nb=
sp;=E2=80=93 Wordfence Free users receive the same protection.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<h2 style=3D"margin:0; mso-line-height-rule:exactly; line-height:175%; font=
-size:22px">Conclusion</h2>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">In this blog po=
st, we detailed an Authorization Bypass and a Stored Cross-Site Scripting v=
ulnerabilities within the&nbsp;<a href=3D"https://email.wordfence.com/e3t/C=
tc/GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23qgyTW7lCdLW=
6lZ3psW3g6SlL4LlkNJW8vsRGn7xn7G2W6bGrK62qdmdZW6nsL9K86HS_JW14ZRFj53clQQM9z_=
yBmzqg-W7fYnSx5fSddyW5tw2pF3xdfq_W39_9Rb8jbPQsN7vRLf3_XNR-W4tqwhP2yDBkNW5xX=
rYK6RRF96W7s4SL86Qmq0kW2dqY_l7W3stsW8kxjgW5Q7Ry4W38TLm8825F0hVqBmqM6rlV0rVM=
ZTXp63tL6ZW3xXBFC5bb2jhW8__5qH2ggHTXW2s8_j47BHg5kN6hsPL02YZY-W8y1_pk3YmnspW=
5r0-cc95wXFkf372g8s04" target=3D"_blank" rel=3D"noopener" style=3D"color:#0=
0a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"1">POST SMTP Mailer=
 plugin</a>&nbsp;affecting versions 2.8.7 and earlier. The Authorization By=
pass vulnerability allows unauthenticated threat actors to reset the API ke=
y used to authenticate to the mailer and view logs, including password rese=
t emails, resulting in a full site compromise. The Stored Cross-Site Script=
ing vulnerability allows unauthenticated threat actors to inject malicious =
web scripts into pages. The vulnerabilities have been fully addressed in ve=
rsion 2.8.8 of the plugin.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">We encourage Wo=
rdPress users to verify that their sites are updated to the latest patched =
version of POST SMTP Mailer.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">Wordfence users=
 running&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04=
/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3mVVWyW2-1r0xs=
JW7BrYFk8Bx48NW9cn9pq50QgL4W587NCN2Y3XtTVqLxch98tvjxW7JJryQ3W7CtzW37sFHT1L_=
Dj_W4PpZfl46zrWkW6wtH362nf2kzW3kCzXb152VZkVRGPXj5hyK2JW4Q4VxT4b1gxzW4lJbMx3=
Y-psHMq_qfPS1zx9VnxyGY4TykS7W2VFDyf8n1vQ3W5GVVH622v9_LN4HzC9-4TYMbW8XP--x68=
jMhcW7Ss3Pw4ddCSmW7XKY9P4vW58-N5D3WHlBQGBnW49N7gl9fbzHxW59zn3x8S7BymW3D_4vC=
4B8WQmW5VmY_g4lhQJpf54ZGGb04" target=3D"_blank" rel=3D"noopener" style=3D"c=
olor:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"1">Wordfence=
 Premium</a>,&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cw=
G7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3kHW732-j=
S8vwvK7W1XNQPR6LmHrBW8_V8gD5HRS2dW2p4Rsg7BPL3-W93kNnW3LX9FRW13hRmR3bCl25W2B=
WwvK5c3Jl_W5HS3_g8fmvhKN1sX8l3cYgLJW3MdQJ63GKZC9W819cHq11b8jQW2Y34f-91KjmhW=
2xW5Tt6c-tV0W23GJMn21pHshW2mbNGl56clQNW52j1797p2lc_N8_tPgmttzVHW4JxHfc6RB2R=
hW6xP04L1X-53mW3CQvPp4ZfL5XN27c-FzwMnYFN2wsj1CvJVmsW9cYN2R7ns0NVW1BJmm12wvt=
CmVN2Dkz5Xr4D9W43ZVR93TtB98f39tK0C04" target=3D"_blank" rel=3D"noopener" st=
yle=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"1">W=
ordfence Care</a>, and&nbsp;<a href=3D"https://email.wordfence.com/e3t/Ctc/=
GC+113/cwG7R04/VXkzDB6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ=
3lMW5lnxlc5Cp5v0W78XRb88sLhxQW1S-Hmq7w1dhTW5M9nv44XypL8W7Xp7XH7P6BgRW5cpVSg=
2JY1wzW2vMNCx4BHP6HW46FQRC8nwdqmW6kDPry8hkgZpW8Kw6Jl5-_Mq0W1GQTzk6GqlrSN3_c=
SXnrwK3JN2VwkVhPq3JMW6zz_zw118DZmW6BKzgT1qM7_-W146t3H3VQhngN6MBRr5NnzZBW3dy=
cL38QFmZGW5_L0n83qPCdmW49QlVb6c72JVW8dB1753rvkt0W7BLLnf2FbFQqW1_snkv2WR4vRW=
7NHJ563N2NKdVZ54M27xzjbFW90-kg31F2SD1f8TWTq404" target=3D"_blank" rel=3D"no=
opener" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-=
id=3D"1">Wordfence Response</a>&nbsp;have been protected against these vuln=
erabilities as of January 3, 2024. Users still using the free version of Wo=
rdfence will receive the same protection on February 2, 2024.</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly; line-height:175%">If you know som=
eone who uses this plugin on their site, we recommend sharing this advisory=
 with them to ensure their site remains secure, as this vulnerability poses=
 a significant risk.</p></div></div></td></tr></tbody></table>
<table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D"1=
00%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-ta=
ble-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" st=
yle=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-family:=
Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; pa=
dding:0px 20px 15px"><div id=3D"hs_cos_wrapper_module-3-0-0" class=3D"hs_co=
s_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color:=
 inherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-ty=
pe=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-=
3-0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_r=
ich_text" style=3D"color: inherit; font-size: inherit; line-height: inherit=
;" data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><h2 s=
tyle=3D"margin:0; mso-line-height-rule:exactly; font-size:20px; line-height=
:175%; text-align:center; font-weight:bold" align=3D"center"><span style=3D=
"font-family: Arial, sans-serif; color: #000000;">The Full Product Lineup</=
span></h2></div></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-4" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3ntN3cvVR0MLRdWW4ML2=
N17fk0lNW1hw9t51y4QRTW7Cp2X97041RWW6QNWhB6bsV-6N4gz2Tp5d4R2W4Z2Rhl6j1gq3W82=
PvJF4sYSCLW23XFQC3S1CHRW2g-svQ1Pb8tSW3FKJrn3BrMgpW8C5q1J20t_QRW9bxgxW455T01=
N1Vjr1dYR28dV7ZCC363RjkcW5-X_8s4DD79_W8pMSz22RZcMRW5L42TL19lp_yW7zw3Qt2T_C3=
DW6GfbPY8J0X0tN4MmSwpB9_yMW2QChxB1Kg7JbW98sg8Z1WXsx6N60B65Vls0ZVN4TTL3C52s_=
JN47gVdb9Stw_f49fGDq04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-=
height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-free-1" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-free-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-free-1.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-free-1.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-free-1.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-free-1.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3m4W2T054C43KlHYV_HV=
kX20CWwFW2MRh3L2kmNFjW2pB8xh8Bg1bmW3rCN1V92LPH5W25JynX16yfKyW3Z3n5168CwwvVb=
9dxH4_Z3X8W65zNcF7qnBs1W8bgHqD10dMpsVlbWwL3wPK96W5YwZbJ1DnHwJW3ZkhmR3_rd5ZW=
7K4wvr2H1yVRVp11tK6chqqFW7jY3_56vXpcmW3rSzSX1n-NpDW5Fd83r2BBBVxW6S2xJm5FDBS=
QW1Pqtwz59TThDW6PT2qR8Rw9x2W1tj89M18zWgNVYc6067SxYVbW8Q146p1z8w47W4dgKBf5R4=
SP1VSvhLW3ZNTHMf8hf7sd04" target=3D"_blank" style=3D"color:#00a4bd; mso-lin=
e-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-premium-1" src=3D"https://email.wordfence.co=
m/hs-fs/hubfs/wf-stacked-premium-1.jpg?width=3D200&amp;upscale=3Dtrue&amp;n=
ame=3Dwf-stacked-premium-1.jpg" style=3D"outline:none; text-decoration:none=
; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size:16=
px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs=
-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D200&amp;upsca=
le=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 100w, https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-premium-1.jpg?upscale=3Dtrue&amp;width=3D400&am=
p;upscale=3Dtrue&amp;name=3Dwf-stacked-premium-1.jpg 200w" sizes=3D"(max-wi=
dth: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-4-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-4-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3pjW2TrSqX4TKR83W2yD=
x_n5l6L2TW3x8JSs5NFkmZW8gRqPW44w7kcW3Jt2XJ8sMN1tW66pVrX3FM858W1BLPPv89Gd4jN=
29Swxmw0_CYN1yznF5WGsb3W10FLXR5R5H1XVzkMkJ49RWjRW6Z0D474G0c48W7zf5NN7c1VRyW=
8M3WK08mbK-NW69MFlx7Y-MFmW5k1L6h8vwmwNW5J5lQb7Mjt1BW2hC7Y96d44KJW9gWK_C2-G-=
y-N53kwCfqF6X4W6y7sBV1nwB3LW2gcvKB3-Z-McW7WpLHZ4R87ZHW8s4Shx8YsTtkW2l5b9b47=
_jcsN3d7SZY7YbW0f7h7Tl404" target=3D"_blank" style=3D"color:#00a4bd; mso-li=
ne-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-care-3" src=3D"https://email.wordfence.com/h=
s-fs/hubfs/wf-stacked-care-3.jpg?width=3D200&amp;upscale=3Dtrue&amp;name=3D=
wf-stacked-care-3.jpg" style=3D"outline:none; text-decoration:none; -ms-int=
erpolation-mode:bicubic; border:none; max-width:100%; font-size:16px" width=
=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs=
/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&am=
p;name=3Dwf-stacked-care-3.jpg 100w, https://email.wordfence.com/hs-fs/hubf=
s/wf-stacked-care-3.jpg?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&a=
mp;name=3Dwf-stacked-care-3.jpg 200w" sizes=3D"(max-width: 100px) 100vw, 10=
0px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-5" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-0" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3nRVNygt96np92qW7FYd=
xz3B4GvDW6QSYpK2Wn0NcW8W30Tm3rj7l8W66ZcxY55YKr8W6slqpm46WTtGN8j65qpdPlYtW5r=
-zJV6JVXCpW8KHbZ143GlVYN7BS35GnBMnNVYB6xF20T0MdW5g55mX1Qc3PTW5mpHjs1TB8gZW4=
g0-c443xXBKW2rcyCr47S34XW7W0jKs1G3ZN_N1Wv7Mtt7d39W5WxgvT3bzTzxW7sTN7d5l1D5p=
W3-_3lt4V5hMnV7hLXm50VbFfW6fPP482ycm7YN3hwsZCdBTkxW75lrx-6tMgC7N3Xwssv-mJzP=
W5yCbzf3SymkCf6v6v6H04" target=3D"_blank" style=3D"color:#00a4bd; mso-line-=
height-rule:exactly" data-hs-link-id=3D"2">
        <img alt=3D"wf-stacked-response-2" src=3D"https://email.wordfence.c=
om/hs-fs/hubfs/wf-stacked-response-2.jpg?width=3D200&amp;upscale=3Dtrue&amp=
;name=3Dwf-stacked-response-2.jpg" style=3D"outline:none; text-decoration:n=
one; -ms-interpolation-mode:bicubic; border:none; max-width:100%; font-size=
:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfence.com=
/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D200&amp;u=
pscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 100w, https://email.word=
fence.com/hs-fs/hubfs/wf-stacked-response-2.jpg?upscale=3Dtrue&amp;width=3D=
400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-response-2.jpg 200w" sizes=3D"=
(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-l3qgyTW7Y8-PT6lZ3pdW48Z7lM7H6PvZW7M3=
fqz91d2BPW88Hgqf7Lb7_xW8GYSk8908bH5W7ZCmGY5S4K2MW2fLLFy13HVS_W4vkTVT11538XW=
1fBlSt8WB7GDW3DRssC6pwWfLW72vL0T5XH6hdW5Zv5237vS-HkW8yvcgr7fQfrZN620_lYnQCC=
CN9kRwHfcp_kYW6Xc-7236tD3WW2xWrC53KtsP_W1-w44m3LGvGfW4ZwP4b6y0PQdW77C2mJ3yy=
CkCW1Qt_h03lYB5zW9fl0Nz3JbxyTW6fjxN33ZZQx0W7VWvbs8rwMPdW1PD8Cy4SLv-GW75h4ZL=
79sC4GW8FvVnr7v8Kfdf2hqGY804" target=3D"_blank" style=3D"color:#00a4bd; mso=
-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-cli" src=3D"https://email.wordfence.com/hs-f=
s/hubfs/wf-stacked-cli.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-sta=
cked-cli.png" style=3D"outline:none; text-decoration:none; -ms-interpolatio=
n-mode:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" =
align=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/wf-stack=
ed-cli.png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dwf-=
stacked-cli.png 100w, https://email.wordfence.com/hs-fs/hubfs/wf-stacked-cl=
i.png?upscale=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stack=
ed-cli.png 200w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-5-2" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-5-2-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23qgyTW7lCdLW6lZ3pQW907rFg8HlxJYW83G=
N7j117x5LW6Fjh7T6gBctyW68NgSP8WFQhjW7w2qbP6v4ZkWW6S1JQ46LXV_QW29p_bb5MbL7wW=
58MF5y2MYnJKW6_gX7V60T2W6W7S31Bw6DH3RRW2nVtx65Dt55mW2n4BCZ7ZLlp9W8BM4B-10C9=
60W4tsDM48bcSTwMYByCgnZpK3Vcmp1x46dkVZVjVggf3pBhmZN8G2P2zv2jpKW7DBGdD2v0697=
W4Gt22w1-2q6ZW7XMbF193Z05lW87g0vh7YfhyyW4JjdtD14-NVcW7Xdx1J4yvTsfdY8byv04" =
target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" dat=
a-hs-link-id=3D"0">
        <img alt=3D"wf-stacked-intelligence" src=3D"https://email.wordfence=
.com/hs-fs/hubfs/wf-stacked-intelligence.png?width=3D200&amp;upscale=3Dtrue=
&amp;name=3Dwf-stacked-intelligence.png" style=3D"outline:none; text-decora=
tion:none; -ms-interpolation-mode:bicubic; border:none; max-width:100%; fon=
t-size:16px" width=3D"100" align=3D"middle" srcset=3D"https://email.wordfen=
ce.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&amp;width=3D2=
00&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 100w, https://=
email.wordfence.com/hs-fs/hubfs/wf-stacked-intelligence.png?upscale=3Dtrue&=
amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dwf-stacked-intelligence.png 2=
00w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-6" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-6-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-6-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><!--[if gte mso 9]>
<div style=3D"line-height: 0; font-size: 0px">
  <v:rect xmlns:v=3D"urn:schemas-microsoft-com:vml" fill=3D"true" stroke=3D=
"false" style=3D"width:560px; height:2pt;" fillcolor=3D"none">
    <v:fill type=3D"tile"/>
    <v:textbox inset=3D"0,0,0,0">
      <div>
<![endif]-->
<table role=3D"presentation" width=3D"100%" align=3D"center" border=3D"0" s=
tyle=3D"position:relative; top:-1px; min-width:20px; width:100%; max-width:=
100%; border-spacing:0; mso-table-lspace:0pt; mso-table-rspace:0pt; border-=
collapse:collapse; font-size:1px">
  <tbody><tr><td width=3D"100%" valign=3D"middle" style=3D"border-collapse:=
collapse; mso-line-height-rule:exactly; font-family:Arial, sans-serif; font=
-size:15px; color:#525355; word-break:break-word; line-height:0; border:tra=
nsparent; border-bottom:2px solid #EEEEEE; mso-border-bottom-alt:2pt solid =
#EEEEEE; border-bottom-width:2px"><!--[if mso 16]>&nbsp;<![endif]--></td></=
tr>
</tbody></table>
<!--[if gte mso 9]>
      </div>
    </v:textbox>
  </v:rect>
</div>
<![endif]--></div></td></tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-7" class=3D"hse-section" style=3D"padding-left:10px; p=
adding-right:10px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border" style=3D"min-width:280=
px; max-width:600px; Margin-left:auto; Margin-right:auto; border-collapse:c=
ollapse; border-spacing:0; border-left:0px solid #008cc1; border-right:0px =
solid #008cc1; box-sizing:border-box; background-color:#FFFFFF" bgcolor=3D"=
#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-left:0px solid #008CC1;bo=
rder-right:0px solid #008CC1" cellpadding=3D"0" cellspacing=3D"0" role=3D"p=
resentation" class=3D"hse-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:400px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"400" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:400px">
<![endif]-->
<div id=3D"column-7-0" class=3D"hse-column hse-size-8">
  <div id=3D"hs_cos_wrapper_module-7-0-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"left" valign=3D"top" style=3D"border=
-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans-s=
erif; color:#525355; word-break:break-word; text-align:left; padding:20px 2=
0px 0px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TNZM3qgyTW6N1vHY6lZ3mzV6J3N786N4_mW3xf2=
Y33rdrSXW1gxmPf5gd0ZHW6CVxzJ4pjgY8W1Mb7LP8QDTbZW7vnQTY3GV2twW2yCP4W1lglDsW5=
3fYmG55mVVrW7c956Y3n5rzqW6GYny_69S9mhW5v01qp8y03KYW5xWStG18Pq8DW5CLDg995lcw=
qW4TZjB38TdynSW4MM8QQ1v9-CMW5lggJ01M7d8DN1zywmh7DPGkW8GKNdN8569wXN8MBMGJKYw=
W_W3BmS2_2_zYz1W51BX8M4Jw3f7W36WVtW6BrmhLdrGX0H04" target=3D"_blank" style=
=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0">
        <img alt=3D"logo-defiant" src=3D"https://email.wordfence.com/hs-fs/=
hubfs/logo-defiant.png?width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png" style=3D"outline:none; text-decoration:none; -ms-interpolation-mode=
:bicubic; border:none; max-width:100%; font-size:16px" width=3D"100" align=
=3D"middle" srcset=3D"https://email.wordfence.com/hs-fs/hubfs/logo-defiant.=
png?upscale=3Dtrue&amp;width=3D200&amp;upscale=3Dtrue&amp;name=3Dlogo-defia=
nt.png 100w, https://email.wordfence.com/hs-fs/hubfs/logo-defiant.png?upsca=
le=3Dtrue&amp;width=3D400&amp;upscale=3Dtrue&amp;name=3Dlogo-defiant.png 20=
0w" sizes=3D"(max-width: 100px) 100vw, 100px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
<div id=3D"hs_cos_wrapper_module-7-0-1" class=3D"hs_cos_wrapper hs_cos_wrap=
per_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size: =
inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-hs=
-cos-type=3D"module"><table role=3D"presentation" class=3D"hse-footer hse-s=
econdary" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"borde=
r-spacing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso=
-table-rspace:0pt; font-family:Arial, sans-serif; font-size:12px; line-heig=
ht:135%; color:#23496d; margin-bottom:0; padding:0">
  <tbody>
    <tr>
      <td align=3D"left" valign=3D"top" style=3D"border-collapse:collapse; =
mso-line-height-rule:exactly; font-family:Arial, sans-serif; font-size:15px=
; color:#525355; word-break:break-word; text-align:left; margin-bottom:0; l=
ine-height:135%; padding:10px 20px">
          <p style=3D"mso-line-height-rule:exactly">Defiant, Inc., 1700 Wes=
tlake Ave N STE 200&nbsp;</p>
<p style=3D"mso-line-height-rule:exactly">Seattle, WA &nbsp;98109&nbsp;Unit=
ed States</p>
<p style=3D"mso-line-height-rule:exactly"><a href=3D"https://email.wordfenc=
e.com/hs/manage-preferences/unsubscribe-all?languagePreference=3Den&amp;d=
=3DVnbTNd892TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3XVmWFfN7W38cSN8ykQ6g25v=
C8W7QGvZ-85QFnNVWRWwc5ZdM5-MXk_7Qbw9G5W9k3YN71vM-JzVs9-Bt4p-WBQ3jzJ2&amp;v=
=3D3&amp;utm_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_source=
=3Dhs_email&amp;utm_medium=3Demail&amp;utm_content=3D289487106&amp;_hsenc=
=3Dp2ANqtz--KYxTu41z8yu5JLuD7kE4WDPYtS78R7PsMxKcP0RsKkEsLyFpIy8Az6xITa85VBt=
oDtucrOQqCQnRCmxtqyiz_ds1f9w&amp;_hsmi=3D289487106" data-unsubscribe=3D"tru=
e" style=3D"color:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D=
"0" target=3D"_blank">Unsubscribe</a> <a href=3D"https://email.wordfence.co=
m/hs/manage-preferences/unsubscribe?languagePreference=3Den&amp;d=3DVnbTNd8=
92TtnVCnbkg45v0QyW3_X4wv3SXQ-tW4h29fm6J4V3XVmWFfN7W38cSN8ykQ6g25vC8W7QGvZ-8=
5QFnNVWRWwc5ZdM5-MXk_7Qbw9G5W9k3YN71vM-JzVs9-Bt4p-WBQ3jzJ2&amp;v=3D3&amp;ut=
m_campaign=3DWordfence%20Intelligence%20Marketing&amp;utm_source=3Dhs_email=
&amp;utm_medium=3Demail&amp;utm_content=3D289487106&amp;_hsenc=3Dp2ANqtz--K=
YxTu41z8yu5JLuD7kE4WDPYtS78R7PsMxKcP0RsKkEsLyFpIy8Az6xITa85VBtoDtucrOQqCQnR=
Cmxtqyiz_ds1f9w&amp;_hsmi=3D289487106" data-unsubscribe=3D"true" style=3D"c=
olor:#00a4bd; mso-line-height-rule:exactly" data-hs-link-id=3D"0" target=3D=
"_blank">Manage Preferences</a></p>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
<!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:200px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"200" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:200px">
<![endif]-->
<div id=3D"column-7-1" class=3D"hse-column hse-size-4">
  <div id=3D"hs_cos_wrapper_module-7-1-0" class=3D"hs_cos_wrapper hs_cos_wr=
apper_widget hs_cos_wrapper_type_module" style=3D"color: inherit; font-size=
: inherit; line-height: inherit;" data-hs-cos-general-type=3D"widget" data-=
hs-cos-type=3D"module"><table class=3D"hse-image-wrapper" role=3D"presentat=
ion" width=3D"100%" cellpadding=3D"0" cellspacing=3D"0" style=3D"border-spa=
cing:0 !important; border-collapse:collapse; mso-table-lspace:0pt; mso-tabl=
e-rspace:0pt">
  <tbody>
    <tr>
      <td class=3D"hs_padded" align=3D"center" valign=3D"top" style=3D"bord=
er-collapse:collapse; mso-line-height-rule:exactly; font-family:Arial, sans=
-serif; color:#525355; word-break:break-word; text-align:center; padding:10=
px 20px; font-size:0px">
        <a href=3D"https://email.wordfence.com/e3t/Ctc/GC+113/cwG7R04/VXkzD=
B6rjWz0W1NMgs72FY8hkW87_Sgk5868yQN6-TN-23qgyTW7lCdLW6lZ3l2W4W31gY88VXbnW6Gg=
k8p4b2gnRW5NZ7d06yFTj0N4MhM54RsHGZW765Q-_2CR0hJW93PjX74-zQncN87lfNT5CkgXW49=
hpjg2wk9YLW51SQK64xxCS9W35Bqzh4ywc03W3RjJ8y6Q6Z3-VZ4W8h6Mpp_0W38HfHr6ZxyyQW=
5vcMMC2zybnXW6K5gNl1ZG3XQW7lM-2D5wzCJMW2lCx-D2r5jRrVhNCcb4KlRDZW5G2-9f2hRZn=
WW6wq2pg85zMvMN7mFzSKRYcnHW82tWNq8-nvclW4qsMSD5KV-gVVj-Hn39chZZhf5Jp1RR04" =
target=3D"_blank" style=3D"color:#00a4bd; mso-line-height-rule:exactly" dat=
a-hs-link-id=3D"0">
        <img alt=3D"ISO_27001" src=3D"https://email.wordfence.com/hs-fs/hub=
fs/ISO_27001.png?width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png" s=
tyle=3D"outline:none; text-decoration:none; -ms-interpolation-mode:bicubic;=
 border:none; max-width:100%; font-size:16px" width=3D"70" align=3D"middle"=
 srcset=3D"https://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3D=
true&amp;width=3D140&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 70w, https=
://email.wordfence.com/hs-fs/hubfs/ISO_27001.png?upscale=3Dtrue&amp;width=
=3D280&amp;upscale=3Dtrue&amp;name=3DISO_27001.png 140w" sizes=3D"(max-widt=
h: 70px) 100vw, 70px">
        </a>
      </td>
    </tr>
  </tbody>
</table></div>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div>
  <div id=3D"section-8" class=3D"hse-section hse-section-last" style=3D"pad=
ding-left:10px; padding-right:10px; padding-bottom:20px">
   =20
   =20
    <!--[if !((mso)|(IE))]><!-- -->
      <div class=3D"hse-column-container hse-border-bottom hse-border" styl=
e=3D"min-width:280px; max-width:600px; Margin-left:auto; Margin-right:auto;=
 border-collapse:collapse; border-spacing:0; border-left:0px solid #008cc1;=
 border-right:0px solid #008cc1; box-sizing:border-box; border-bottom:0px s=
olid #008cc1; background-color:#FFFFFF" bgcolor=3D"#FFFFFF">
    <!--<![endif]-->
   =20
    <!--[if (mso)|(IE)]>
      <div class=3D"hse-column-container" style=3D"min-width:280px;max-widt=
h:600px;width:100%;Margin-left:auto;Margin-right:auto;border-collapse:colla=
pse;border-spacing:0;">
      <table align=3D"center" style=3D"border-collapse:collapse;mso-table-l=
space:0pt;mso-table-rspace:0pt;width:600px;border-bottom:0px solid #008CC1;=
border-left:0px solid #008CC1;border-right:0px solid #008CC1" cellpadding=
=3D"0" cellspacing=3D"0" role=3D"presentation" class=3D"hse-border-bottom h=
se-border" width=3D"600" bgcolor=3D"#FFFFFF">
      <tr style=3D"background-color:#FFFFFF;">
    <![endif]-->
    <!--[if (mso)|(IE)]>
  <td valign=3D"top" style=3D"width:600px;">
<![endif]-->
<!--[if gte mso 9]>
  <table role=3D"presentation" width=3D"600" cellpadding=3D"0" cellspacing=
=3D"0" style=3D"border-collapse:collapse;mso-table-lspace:0pt;mso-table-rsp=
ace:0pt;width:600px">
<![endif]-->
<div id=3D"column-8-0" class=3D"hse-column hse-size-12">
  <table role=3D"presentation" cellpadding=3D"0" cellspacing=3D"0" width=3D=
"100%" style=3D"border-spacing:0 !important; border-collapse:collapse; mso-=
table-lspace:0pt; mso-table-rspace:0pt"><tbody><tr><td class=3D"hs_padded" =
style=3D"border-collapse:collapse; mso-line-height-rule:exactly; font-famil=
y:Arial, sans-serif; font-size:15px; color:#525355; word-break:break-word; =
padding:10px 20px"><div id=3D"hs_cos_wrapper_module-8-0-0" class=3D"hs_cos_=
wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_module" style=3D"color: i=
nherit; font-size: inherit; line-height: inherit;" data-hs-cos-general-type=
=3D"widget" data-hs-cos-type=3D"module"><div id=3D"hs_cos_wrapper_module-8-=
0-0_" class=3D"hs_cos_wrapper hs_cos_wrapper_widget hs_cos_wrapper_type_ric=
h_text" style=3D"color: inherit; font-size: inherit; line-height: inherit;"=
 data-hs-cos-general-type=3D"widget" data-hs-cos-type=3D"rich_text"><p styl=
e=3D"mso-line-height-rule:exactly; font-size:11px; line-height:175%; text-a=
lign:center" align=3D"center">You're receiving this email because you signe=
d up for Wordfence's WordPress security mailing list.</p></div></div></td><=
/tr></tbody></table>
</div>
<!--[if gte mso 9]></table><![endif]-->
<!--[if (mso)|(IE)]></td><![endif]-->
    <!--[if (mso)|(IE)]></tr></table><![endif]-->
    </div>
  =20
  </div></div>
          </td>
        </tr>
      </tbody></table>
    </div>
 =20
<img src=3D"https://email.wordfence.com/e3t/Cto/GC+113/cwG7R04/VXkzDB6rjWz0=
W1NMgs72FY8hkW87_Sgk5868yQW6-TNKS3D2Fr7122" alt=3D"" width=3D"1" height=3D"=
1" border=3D"0" style=3D"display:none!important;min-height:1px!important;wi=
dth:1px!important;border-width:0!important;margin-top:0!important;margin-bo=
ttom:0!important;margin-right:0!important;margin-left:0!important;padding-t=
op:0!important;padding-bottom:0!important;padding-right:0!important;padding=
-left:0!important"></body></html>
------=_Part_25895708_1353425290.1704905846186--

