PT-2018-13262 · WordPress · Ajax-Bootmodal-Login

Published 2018-08-26 · Updated 2018-10-17 · CVE-2018-15876

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions ajax-bootmodal-login plugin version 1.4.3

Description The issue concerns the ajax-bootmodal-login plugin for WordPress, where the register, login, and password-recovery forms require solving a CAPTCHA. However, this CAPTCHA is only required once per user session, allowing an attacker to send multiple requests through automation after solving the CAPTCHA a single time.

Recommendations For version 1.4.3, consider implementing a more robust CAPTCHA solution that requires verification for each action, or restrict the number of requests that can be made within a single user session to mitigate the risk of automation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-15876

Affected Products

Ajax-Bootmodal-Login

References · 3

• 🔥❌ https://github.com/aas-n/CVE/tree/master/ajax-bootmodal-login · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-15876 · Security Note
• https://osv.dev/vulnerability/CVE-2018-15876 · Vendor Advisory