← Retour aux CVEs

CVE-2023-5089

MEDIUM

5.3

Description

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

Details CVE

Score CVSS v3.15.3

SeveriteMEDIUM

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/16/2023

Derniere modification4/23/2025

Sourcenvd

Observations honeypot0

Produits affectes

wpmudev:defender_security

References

https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d(contact@wpscan.com)

https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms(contact@wpscan.com)

https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d(af854a3a-2127-422b-91ae-364da2661108)

https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.