PT-2024-13471 · Miniorange · Miniorange Wordpress Social Login/Register

Rafie Muhammad · Published 2024-05-17 · Updated 2024-07-10 · CVE-2023-47683

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions miniOrange WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) versions n/a through 7.6.6

Description The issue is related to improper privilege management, allowing privilege escalation. This can lead to unauthorized access.

Recommendations Update the plugin immediately to a version later than 7.6.6 and review user privileges to mitigate the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2023-47683

Affected Products

Miniorange Wordpress Social Login/Register

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-47683 · Security Note
• https://t.me/cvenotify/80212 · Telegram Post
• https://twitter.com/oktsec/status/1810934365502796075 · Twitter Post
• https://twitter.com/CveFindCom/status/1791409049159819590 · Twitter Post
• https://twitter.com/CVEnew/status/1791390953850438012 · Twitter Post
• https://patchstack.com/database/vulnerability/miniorange-login-openid/wordpress-social-login-social-sharing-by-miniorange-plugin-7-6-6-authenticated-privilege-escalation-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1791444556161884461 · Twitter Post