CVE-2023-5089

2023-10-1620:15:17

[email protected]

web.nvd.nist.gov

cve-2023-5089

wordpress plugin

security vulnerability

authentication bypass

nvd

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

0.002 Low

EPSS

Percentile

61.4%

JSON

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

Affected configurations

Vulners

NVD

Node

microsoftdefender_security_intelligence_updatesRange<4.1.0

VendorProductVersionCPE
microsoftdefender_security_intelligence_updates*cpe:2.3:a:microsoft:defender_security_intelligence_updates:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	defender_security_intelligence_updates	*	cpe:2.3:a:microsoft:defender_security_intelligence_updates::::::::

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Defender Security",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "4.1.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]