PT-2018-13262 · WordPress · Ajax-Bootmodal-Login

Publicado 2018-08-26 · Atualizado 2018-10-17 · CVE-2018-15876

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ajax-bootmodal-login plugin version 1.4.3

Description The issue concerns the ajax-bootmodal-login plugin for WordPress, where the register, login, and password-recovery forms require solving a CAPTCHA. However, this CAPTCHA is only required once per user session, allowing an attacker to send multiple requests through automation after solving the CAPTCHA a single time.

Recommendations For version 1.4.3, consider implementing a more robust CAPTCHA solution that requires verification for each action, or restrict the number of requests that can be made within a single user session to mitigate the risk of automation.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-15876

Produtos afetados

Ajax-Bootmodal-Login

Referências · 3

• 🔥❌ https://github.com/aas-n/CVE/tree/master/ajax-bootmodal-login · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-15876 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-15876 · Aviso do Fabricante