CVE-2023-6042 is a high severity (CVSS 7.5 in the record) flaw in the Getwid WordPress plugin before 2.0.3. Any unauthenticated user can make the site send email to the admin with a title and content of their choosing. Update to 2.0.3 or later. WPScan scores it 5.3 Medium.
What's affected
- Plugin: Getwid by MotoPress.
- Affected: versions before 2.0.3.
- Fixed: 2.0.3, per WPScan.
- Severity: 7.5 High in the NVD record. WPScan scores it 5.3 Medium.
- What is at stake: the message arrives from the site itself, so an admin may trust it.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Getwid. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Getwid and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. The folder is getwid.
A version below 2.0.3 is affected. Check your administrator mailbox for odd messages that look like system notices, such as fake update or security requests that you did not expect.
What to do now
- Update Getwid to 2.0.3 or later.
- Remind administrators that site generated emails can be forged by outsiders on vulnerable sites, and that they should not click links in unexpected notices.
- Look through the admin mailbox for past messages that look like fake WordPress or hosting notices.
- Add rate limits or a web application firewall rule for the plugin's AJAX mail action if you cannot update right away.
- Review which other forms on the site send mail, and confirm each one has a nonce and rate limiting.
Why it matters
The plugin has an AJAX handler that sends email from the site to the administrator and does not properly confirm who is calling it. WPScan classes it as an authentication bypass, CWE-287. The attacker controls the subject and the message, but the recipient is fixed, so this is not a general spam relay.
Why does that matter? The mail comes from a trusted sender, the site itself, and goes to the person with the most power over it. That makes it a good vehicle for phishing: a fake notice that tells an administrator to install an update or log in somewhere. The technical flaw is small and the risk is human. The record does not list this CVE as known exploited, and no weakness identifier appears in the record, so no Gold CWE page is linked here.
Quick check
Can the attacker choose the recipient?
According to the description, the email goes to the site administrator. The attacker chooses the title and content, not the recipient.
Sources
Last reviewed: 19 October 2026.
