CVE-2023-2549

The CVE-2023-2549 entry documents a CSRF vulnerability in the Feather Login Page plugin for WordPress, affecting versions 1.0.7 through 1.1.1. Root cause: missing nonce validation in the createTempAccountLink function. Consequence: unauthenticated attackers can create a new user with administrato...

CVE-2023-2545

CVE-2023-2545 : The Feather Login Page plugin for WordPress (versions 1.0.7–1.1.1) has two concrete flaws. First, a missing capability check on the getListOfUsers function allows authenticated users with subscriber-level permissions and above to access login links, enabling potential privilege es...

CVE-2023-2547

CVE-2023-2547 concerns the Feather Login Page WordPress plugin. A missing capability check in the plugin’s deleteUser path (versions 1.0.7 through 1.1.1) allows authenticated users with subscriber-level permissions and above to delete the plugin’s temporary users, constituting a broken access con...