Medium severity4.3NVD Advisory· Published Jan 3, 2024· Updated Apr 8, 2026

CVE-2023-6980

Description

The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.5. This is due to missing or incorrect nonce validation on the 'delete' action of the wp-sms-subscribers page. This makes it possible for unauthenticated attackers to delete subscribers via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Veronalabs/Wp Sms
cpe:2.3:a:veronalabs:wp_sms:*:*:*:*:free:wordpress:*:*
Range: <6.5.1
WordPress/Wp Smsllm-fuzzy
Range: <=6.5
Package: https://wordpress.org/plugins/wp-sms

Patches

Vulnerability mechanics

References

github.com/wp-sms/wp-sms/commit/0f36e2f521ade8ddfb3e04786defe074370afb50nvdPatch
plugins.trac.wordpress.org/changesetnvdPatch
www.wordfence.com/threat-intel/vulnerabilities/id/94ad6b51-ff8d-48d5-9a70-1781d13990a5nvdPatchThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.280
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000