Vulnerability · Published Jan 30, 2023 · Assigned by Wordfence
CVE-2023-0581PrivateContent <= 8.4.3 - Protection Mechanism Bypass
Medium 5.3
In plain English
A medium-severity security flaw in PrivateContent from LCWeb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 55% of all known vulnerabilities).
Official description
The PrivateContent plugin for WordPress is vulnerable to protection mechanism bypass due to the use of client side validation in versions up to, and including, 8.4.3. This is due to the plugin checking if an IP had been blocklist via client-side scripts rather than server-side. This makes it possible for unauthenticated attackers to bypass any login restrictions that may prevent a brute force attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LCWeb | PrivateContent | 0 – through 8.4.3 |
Weakness: CWE-602 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N