Vulnerability · Published Jun 19, 2024 · Assigned by jpcert
CVE-2024-37881
Medium 5.3
In plain English
A medium-severity open redirect in SiteGuard WP Plugin from EG Secure Solutions Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| EG Secure Solutions Inc. | SiteGuard WP Plugin | prior to 1.7.7 |
Weakness: CWE-601, CWE-201 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N