PT-2024-36135 · Unknown · Login Widget With Shortcode

Muhamad Agil Fachrian · Published 2024-12-09 · Updated 2024-12-09 · CVE-2024-54255

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Login Widget With Shortcode versions n/a through 6.1.2

Description: The issue is an Open Redirect vulnerability that allows phishing attacks. This vulnerability exists in the Login Widget With Shortcode and can be exploited to redirect users to untrusted sites.

Recommendations: For versions n/a through 6.1.2, update to a version later than 6.1.2 to resolve the issue. As a temporary workaround, consider restricting access to the Login Widget With Shortcode to minimize the risk of exploitation. Avoid using the Login Widget With Shortcode until the issue is resolved.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2024-54255

Affected Products

Login Widget With Shortcode

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-54255 · Security Note
• https://t.me/cvedetector/12370 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1866115732716568765 · Twitter Post
• https://twitter.com/CVEnew/status/1866084801859469688 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/login-sidebar-widget/vulnerability/wordpress-login-widget-with-shortcode-plugin-6-1-2-open-redirection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/login-sidebar-widget/vulnerability/wordpress-login-widget-with-shortcode-plugin-6-1-2-open-redirection-vulnerability?_s_id=cve · Note