CVE-2023-6036

🗓️ 12 Feb 2024 16:06:00Reported by WPScanType

cve🔗 web.nvd.nist.gov👁 93 Views🌐 WEB

Web3 WordPress plugin authentication bypass CVE-2023-603

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Incorrect Authorization in Miniorange Web3_-_Crypto_Wallet_Login_\&_Nft_Token_Gating	31 Jan 202416:58	–	githubexploit
BDU FSTEC	The vulnerabilities of the `handle_login_request()` and `handle_auth_request()` functions of the Web3 plugin – a crypto wallet login & NFT token-gating system for WordPress website content management systems – allow attackers to bypass existing security restrictions.	6 Feb 202400:00	–	bdu_fstec
Circl	CVE-2023-6036	1 Feb 202411:03	–	circl
CNNVD	WordPress Plugin Web3 Security Vulnerability	12 Feb 202400:00	–	cnnvd
Cvelist	CVE-2023-6036 Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass	12 Feb 202416:06	–	cvelist
NVD	CVE-2023-6036	12 Feb 202416:15	–	nvd
OSV	CVE-2023-6036	12 Feb 202416:15	–	osv
Patchstack	WordPress Web3 – Crypto wallet Login & NFT token gating Plugin < 3.0.0 is vulnerable to Broken Authentication	13 Feb 202400:00	–	patchstack
Prion	Authentication flaw	12 Feb 202416:15	–	prion
Positive Technologies	PT-2024-1507 · WordPress · Web3	17 Jan 202400:00	–	ptsecurity

NVD

Vulners

Node

miniorange web3_-_crypto_wallet_login_&_nft_token_gatingRange<3.0.0wordpress

[
  {
    "vendor": "Unknown",
    "product": "Web3",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "3.0.0"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/

Parameter	Position	Path	Description	CWE
action	request body	wp-admin/admin-ajax.php	Authentication bypass via login flow exploiting admin-ajax.php with crafted nonce parameters	CWE-863
request	request body	wp-admin/admin-ajax.php	Authentication bypass via login flow exploiting admin-ajax.php with crafted nonce parameters	CWE-863
address	request body	wp-admin/admin-ajax.php	Authentication bypass via login flow exploiting admin-ajax.php with crafted nonce parameters	CWE-863
mo_web3_verify_nonce	request body	wp-admin/admin-ajax.php	Authentication bypass via login flow exploiting admin-ajax.php with crafted nonce parameters	CWE-863
address	request body	wp-admin/admin-ajax.php	Follow-up step in authentication bypass sending nonce and hidden form nonce to complete login as a target user	CWE-863
nonce	request body	wp-admin/admin-ajax.php	Follow-up step in authentication bypass sending nonce and hidden form nonce to complete login as a target user	CWE-863
mo_web3_hiddenform_nonce	request body	wp-admin/admin-ajax.php	Follow-up step in authentication bypass sending nonce and hidden form nonce to complete login as a target user	CWE-863

17 Jun 2026 06:49Current

6.6Medium risk

Vulners AI Score6.6

CVSS 3.19.8

EPSS0.01773

SSVC

CWE-863