PT-2023-31704 · WordPress · Defender Security

Juan Pablo Gomez Postigo · Publicado 2023-10-16 · Atualizado 2026-03-16 · CVE-2023-5089

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Defender Security WordPress plugin versions prior to 4.1.0

Description The issue allows an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled, due to the plugin not preventing redirects to the login page via the auth redirect WordPress function.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the hide login page functionality until a patch is available. Restrict access to the login page to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2023-5089

Produtos afetados

Defender Security

Referências · 9

• 🔥 https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d · Exploit
• 🔥 https://sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms · Exploit
• https://twitter.com/SprocketSec/status/1717665406771478719 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-5089 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-5089 · Aviso do Fabricante
• https://twitter.com/s1kr10s/status/2033610201853542904 · Publicação no Twitter
• https://twitter.com/s1kr10s/status/2033600575309287526 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1714006515466555778 · Publicação no Twitter
• https://t.me/cibsecurity/72374 · Publicação no Telegram