CVE-2023-6036

2024-02-1216:15:07

[email protected]

web.nvd.nist.gov

web3 wordpress plugin

authentication bypass

incorrect authentication checking

non-authenticated attackers

administrator access

6.4 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions ‘handle_auth_request’ and ‘hadle_login_request’. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.