CVE-2023-2982

miniorange wordpress social login and register (discord, google, twitter, linkedin)

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2023-2982

Katalog CVE

CVSS 9.8 · Critical EPSS 46,2%

Kerentanan Authentication Bypass Using an Alternate Path or Channel pada miniorange wordpress social login and register (discord, google, twitter, linkedin). Skor CVSS 3.1 9.8 (Critical) menurut wordfence.com.

Deskripsi (NVD)

The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. This is due to insufficient encryption on the user being supplied during a login validated through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they know the email address associated with that user. This was partially patched in version 7.6.4 and fully patched in version 7.6.5.

Rincian

Terbit di NVD
29 Juni 2023
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-288: Authentication Bypass Using an Alternate Path or Channel
EPSS (30 hari)
46,2% peluang dieksploitasi; lebih tinggi dari 98,7% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
miniorange wordpress social login and register (discord, google, twitter, linkedin) Semua versi sebelum 7.6.5

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.