The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ | Exploit Third Party Advisory |
| https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ | Exploit Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:43
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ - Exploit, Third Party Advisory |
08 Oct 2024, 20:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ - Exploit, Third Party Advisory | |
| First Time |
Miniorange
Miniorange web3 - Crypto Wallet Login \& Nft Token Gating |
|
| CWE | CWE-863 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:miniorange:web3_-_crypto_wallet_login_\&_nft_token_gating:*:*:*:*:*:wordpress:*:* |
12 Feb 2024, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-12 16:15
Updated : 2024-11-21 08:43
NVD link : CVE-2023-6036
Mitre link : CVE-2023-6036
CVE.ORG link : CVE-2023-6036
JSON object : View
Products Affected
miniorange
- web3_-_crypto_wallet_login_\&_nft_token_gating
CWE
CWE-863
Incorrect Authorization