Vulnerability · Published Oct 16, 2023 · Assigned by WPScan
CVE-2023-5089Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
Medium 5.3
In plain English
A medium-severity security flaw in Defender Security from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.5% (higher than 85% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.5%top 15.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling2Nuclei, Public PoC
Official description
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Defender Security | 0 – before 4.1.0 |
References
- https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d exploit, vdb-entry, technical-description
- https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms