PT-2023-20921 · WordPress · Otp Login Woocommerce & Gravity Forms

István Márton + 1 · Published 2023-05-17 · Updated 2023-06-06 · CVE-2023-2706

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OTP Login Woocommerce & Gravity Forms plugin for WordPress (affected versions not specified)

Description The OTP Login Woocommerce & Gravity Forms plugin for WordPress has an issue that allows authentication bypass. This happens because the plugin returns OTP codes in an AJAX response when generating them for user login via phone number. As a result, unauthenticated attackers can obtain login codes for administrators if they have access to the configured phone number, which can be obtained through social engineering or reconnaissance.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-2706

Affected Products

Otp Login Woocommerce & Gravity Forms

References · 9

• https://osv.dev/vulnerability/CVE-2023-2706 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2706 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-login-woocommerce&sfp_email=&sfph_mail= · Patch
• https://t.me/cvenotify/51150 · Telegram Post
• https://t.me/cibsecurity/64289 · Telegram Post
• https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.2/includes/class-xoo-ml-verification.php#L362 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/b1b7b653-496f-467a-9513-4be1891f38ae?source=cve · Note
• https://lana.codes/lanavdb/87b5e80e-fd5b-47c3-bf82-088bdf4573b5 · Note
• https://t.me/cvenotify/51808 · Telegram Post