CVE-2023-6036

Katalog CVE

CVSS 9.8 · Critical EPSS 1,8%

Kerentanan Incorrect Authorization pada miniorange web3 - crypto wallet login & nft token gating. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Rincian

Terbit di NVD

12 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-863: Incorrect Authorization

EPSS (30 hari)

1,8% peluang dieksploitasi; lebih tinggi dari 77,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ exploit · advisory pihak ketiga