PT-2024-11681 · WordPress · Wp 2Fa

Snicco · Published 2024-06-21 · Updated 2024-06-24 · CVE-2022-44587

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP 2FA versions through 2.6.3

Description The issue affects the WP 2FA plugin, allowing insertion of sensitive information into log files. This enables accessing functionality not properly constrained by Access Control Lists (ACLs).

Recommendations For WP 2FA versions through 2.6.3, update to a version later than 2.6.3 to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2022-44587

Affected Products

Wp 2Fa

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-44587 · Security Note
• https://osv.dev/vulnerability/CVE-2022-44587 · Vendor Advisory
• https://patchstack.com/database/vulnerability/wp-2fa/wordpress-wp-2fa-plugin-2-6-3-sensitive-data-exposure-via-log-file-vulnerability?_s_id=cve · Note