PT-2023-31704 · WordPress · Defender Security

Juan Pablo Gomez Postigo · Published 2023-10-16 · Updated 2026-03-16 · CVE-2023-5089

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Defender Security WordPress plugin versions prior to 4.1.0

Description The issue allows an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled, due to the plugin not preventing redirects to the login page via the auth redirect WordPress function.

Recommendations For versions prior to 4.1.0, update to version 4.1.0 or later to resolve the issue. As a temporary workaround, consider disabling the hide login page functionality until a patch is available. Restrict access to the login page to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2023-5089

Affected Products

Defender Security

References · 9

• 🔥 https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d · Exploit
• 🔥 https://sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-5089 · Security Note
• https://osv.dev/vulnerability/CVE-2023-5089 · Vendor Advisory
• https://twitter.com/SprocketSec/status/1717665406771478719 · Twitter Post
• https://twitter.com/s1kr10s/status/2033610201853542904 · Twitter Post
• https://twitter.com/s1kr10s/status/2033600575309287526 · Twitter Post
• https://twitter.com/CVEnew/status/1714006515466555778 · Twitter Post
• https://t.me/cibsecurity/72374 · Telegram Post