The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Metrics
Affected Vendors & Products
References
History
Tue, 03 Dec 2024 17:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published: 2023-06-30T01:56:18.057Z
Updated: 2024-12-03T16:21:55.851Z
Reserved: 2023-06-14T19:17:34.491Z
Link: CVE-2023-3249
Vulnrichment
Updated: 2024-08-02T06:48:08.498Z
NVD
Status : Modified
Published: 2023-06-30T02:15:09.543
Modified: 2024-11-21T08:16:47.930
Link: CVE-2023-3249
Redhat
No data.