PT-2021-15865 · WordPress · Wp Login Security/History

M0Ze + 1 · Published 2021-06-01 · Updated 2022-07-29 · CVE-2021-24328

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions WP Login Security and History WordPress plugin versions prior to 1.1

Description The issue allows attackers to modify the plugin's settings to arbitrary values and set XSS payloads due to the lack of CSRF checks and sanitisation or validation on settings. This could potentially affect administrators who are logged in.

Recommendations For WP Login Security and History WordPress plugin versions prior to 1.1, update to version 1.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings page to minimize the risk of exploitation.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2021-24328

Affected Products

Wp Login Security/History

References · 7

• 🔥 https://wpscan.com/vulnerability/eeb41d7b-8f9e-4a12-b65f-f310f08e4ace · Exploit
• 🔥 https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-79%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt · Exploit
• 🔥 https://m0ze.ru/exploit/csrf-wp-login-security-and-history-v1.0.html · Exploit
• 🔥 https://m0ze.ru/vulnerability/[2021-03-29]-[WordPress]-[CWE-352]-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24328 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24328 · Vendor Advisory
• https://m0ze.ru/vulnerability/%5B2021-03-29%5D-%5BWordPress%5D-%5BCWE-352%5D-WP-Login-Security-and-History-WordPress-Plugin-v1.0.txt · Note