PT-2024-27808 · WordPress · Siteguard Wp Plugin

Yuta Watanabe · Published 2024-06-19 · Updated 2024-08-01 · CVE-2024-37881

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions SiteGuard WP Plugin versions prior to 1.7.7

Description The issue concerns the SiteGuard WP Plugin's functionality to customize the path to the login page wp-login.php. It was found that versions of the plugin prior to 1.7.7 failed to implement a measure to prevent redirection from wp-register.php, potentially exposing the customized login page path.

Recommendations For versions prior to 1.7.7, update to version 1.7.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the wp-register.php page to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-201

CWE-601

Related Identifiers

CVE-2024-37881

Affected Products

Siteguard Wp Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2024-37881 · Security Note
• https://plugins.trac.wordpress.org/changeset/3094238/siteguard/trunk/classes/siteguard-rename-login.php?old=2888160&old_path=siteguard%2Ftrunk%2Fclasses%2Fsiteguard-rename-login.php · Note
• https://jvn.jp/en/jp/JVN60331535 · Note
• https://t.me/cvenotify/83733 · Telegram Post
• https://jp-secure.com/siteguard_wp_plugin_en/vuls/WPV2024001_en.html · Note