PT-2024-37770 · WordPress · Wp Hardening – Fix Your Wordpress Security

Felipe Caon · Published 2024-09-17 · Updated 2024-09-25 · CVE-2024-6641

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions The WP Hardening – Fix Your WordPress Security plugin versions up to, and including, 1.2.6

Description The issue is due to the use of an incorrect regular expression within the "Stop User Enumeration" feature, making it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.

Recommendations For versions up to, and including, 1.2.6, update to a version later than 1.2.6 to resolve the issue. As a temporary workaround, consider disabling the "Stop User Enumeration" feature until a patch is available.

Fix

Weakness Enumeration

CWE-185

CWE-697

Related Identifiers

CVE-2024-6641

Affected Products

Wp Hardening – Fix Your Wordpress Security

References · 7

• https://osv.dev/vulnerability/CVE-2024-6641 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/3151308/wp-security-hardening · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-6641 · Security Note
• https://t.me/cvedetector/5903 · Telegram Post
• https://twitter.com/CVEnew/status/1836281808540905703 · Twitter Post
• https://t.me/cvenotify/95037 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7a52a278-1729-4027-8a00-e9804fa6698b?source=cve · Note