CVE-2019-15871

CVE-2019-15871 affects the WordPress LoginPress plugin prior to version 1.1.4. The root cause is a missing capability check for updates to settings, enabling unauthorized actions related to configuration changes. Public references confirm the issue in/LoginPress plugin and echo the need for a ven...

CVE-2019-15872

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

CVE-2019-15872

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

CVE-2019-15872

CVE-2019-15872 affects the WordPress LoginPress plugin prior to version 1.1.4, with a SQL injection via an import of settings. The NVD entry rates CVSSv3 as 9.8 (CRITICAL) and CVSSv2 as 7.5 (HIGH). Multiple sources corroborate: vulnerability in LoginPress

PT-2019-14451

Name of the Vulnerable Software and Affected Versions LoginPress plugin versions prior to 1.1.4 Description The issue concerns the lack of capability checks for updates to settings in the LoginPress plugin for WordPress. Recommendations For versions prior to 1.1.4, update to version 1.1.4 or late...

PT-2019-14452

Name of the Vulnerable Software and Affected Versions LoginPress plugin versions prior to 1.1.4 Description The issue allows for SQL injection through an import of settings. Recommendations For versions prior to 1.1.4, update to version 1.1.4 or later to resolve the issue...

CVE-2019-15871: Missing Authorization

The LoginPress plugin before 1.1.4 for WordPress has no capability check for updates to settings...

CVE-2019-15872: Improper Neutralization of Special Elements used in an SQL Command

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

LoginPress <= 1.1.13 - Unauthorized Blind SQL Injection

The Custom Login Page Customizer | LoginPress WordPress plugin was affected by an Unauthorized Blind SQL Injection security vulnerability...

LoginPress <= 1.1.15 - Authenticated Blind SQL Injection

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...