PT-2023-16329 · WordPress · Enable/Disable Auto Login When Register

Lana Codes · CVE-2023-0522 · Publicado 2023-05-08 · Atualizado 2023-05-12

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Enable/Disable Auto Login when Register WordPress plugin versions 1.1.0 and earlier

Description The issue concerns a lack of CSRF check when updating settings in the Enable/Disable Auto Login when Register WordPress plugin. This could allow attackers to make a logged-in admin change settings via a CSRF attack.

Recommendations For Enable/Disable Auto Login when Register WordPress plugin versions 1.1.0 and earlier, consider disabling the settings update functionality until a patch is available. Restrict access to the plugin's settings to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2023-0522

Produtos afetados

Enable/Disable Auto Login When Register

Referências · 4

• 🔥 https://wpscan.com/vulnerability/c7984bfb-86a3-4530-90ae-17ab39af1c54 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-0522 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-0522 · Aviso do Fabricante
• https://t.me/cibsecurity/63443 · Publicação no Telegram