PT-2023-23823 · WordPress · Web3

István Márton + 1 · Published 2023-06-30 · Updated 2023-07-06 · CVE-2023-3249

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Web3 – Crypto wallet Login & NFT token gating plugin for WordPress versions up to, and including, 2.6.0

Description The issue is related to incorrect authentication checking in the hidden form data function, allowing authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Recommendations For versions up to, and including, 2.6.0, consider disabling the hidden form data function until a patch is available to prevent exploitation. Restrict access to sensitive areas of the site to minimize the risk of unauthorized access.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2023-3249

Affected Products

Web3

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-3249 · Security Note
• https://plugins.trac.wordpress.org/browser/web3-authentication/tags/2.6.0/classes/common/Web3/controller/class-moweb3flowhandler.php#L198 · Patch
• https://osv.dev/vulnerability/CVE-2023-3249 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2933325 · Note
• https://t.me/cvenotify/53804 · Telegram Post
• https://t.me/cvenotify/53358 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/e30b62de-7280-4c29-b882-dfa83e65966b?source=cve · Note