Vulnerability · Published Nov 24, 2021 · Assigned by Patchstack
CVE-2021-36917WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability
Medium 6.5
In plain English
A medium-severity improper access control in Hide My WP (WordPress plugin) from wpWave. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)2.0%top 19.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| wpWave | Hide My WP (WordPress plugin) | <= 6.2.3 – through 6.2.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
References
- https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158 x_refsource_CONFIRM
- https://patchstack.com/hide-my-wp-vulnerabilities-fixed/ x_refsource_MISC
- https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability x_refsource_MISC