PT-2022-13578 · Siteground · Siteground Security Plugin

Chloe Chamberland · Published 2022-04-19 · Updated 2024-01-11 · CVE-2022-0993

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SiteGround Security plugin for WordPress versions up to, and including, 1.2.5

Description The issue allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success.

Recommendations For versions up to, and including, 1.2.5, update to a version that includes the necessary identity verification for the 2FA back-up code implementation to prevent authentication bypass. As a temporary workaround, consider disabling the 2FA back-up code feature until a patch is available.

Exploit

Fix

Missing Authentication

Improper Authorization

Weakness Enumeration

CWE-306

CWE-285

Related Identifiers

CVE-2022-0993

Affected Products

Siteground Security Plugin

References · 9

• 🔥 https://wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/https://wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2022-0993 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2706302 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0993 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c93-e59abf913d04?source=cve · Note
• https://t.me/cvenotify/67018 · Telegram Post
• https://t.me/cibsecurity/41151 · Telegram Post
• https://wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin · Note
• https://t.me/cvenotify/54875 · Telegram Post