← Back to CVEs

CVE-2023-5089

MEDIUM

5.3

Description

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

CVE Details

CVSS v3.1 Score5.3

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published10/16/2023

Last Modified4/23/2025

Sourcenvd

Honeypot Sightings0

Affected Products

wpmudev:defender_security

References

https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d(contact@wpscan.com)

https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms(contact@wpscan.com)

https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d(af854a3a-2127-422b-91ae-364da2661108)

https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.