iThemes Security <= 5.6.1 - Sensitive Information Exposure via Diff Response
Strategic Overview
- Status
- Patched in 5.6.2
- Affected Version
<= 5.6.1- CVSS
- 5.3Medium
- Weakness type
- CWE-204 · Observable Response Discrepancy
- CVE
CVE pending
At a glance
This record tracks a medium-severity Observable Response Discrepancy vulnerability in the Kadence Security WordPress plugin, affecting versions <= 5.6.1. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 5.6.2; sites on affected versions should update now. Disclosed September 2016, reported by Leon Atkinson of 18INT.
Vulnerability Overview
The iThemes Security plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including 5.6.1, due to invalid username/password combinations returning different HTTP headers on response. This makes it possible for attackers to observe differences in responses to determine valid usernames on the site (username enumeration).
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-204: Observable Response Discrepancy
Reaching this weakness in Kadence Security <= 5.6.1 takes a caller who can reach the endpoint. An observable response discrepancy means the system answers two different situations in two distinguishable ways, so the difference itself carries information the caller was not meant to have.
An attacker enumerates valid accounts, emails or records by reading the difference, which turns a blind guess into a targeted one before any password is tried. For Kadence Security the fix is 5.6.2: builds <= 5.6.1 are affected, anything from 5.6.2 onward is not.
Remediation
Update to version 5.6.2, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: Kadence Security 5.6.2 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Other vulnerabilities in Kadence Security – Password, Two Factor Authentication, and Brute Force Protection
- 8.3iThemes Security < 3.6.4 Stored Cross-Site Scripting
- 7.5CVE-2020-36176: iThemes Security <= 7.6.1 Broken Password Mechanism
CVE-2020-36176 - 7.5CVE-2018-7433: iThemes Security <= 6.9.0 Cross-Site Scripting
CVE-2018-7433 - 7.4iThemes Security <= 5.3.5 Missing Capabilities Check
- 7.2CVE-2018-12636: iThemes Security <= 7.0.2 SQL Injection
CVE-2018-12636 - 7.2Better WP Security <= 3.5.3 Stored Cross-Site Scripting
- 7.2CVE-2012-4263: iThemes Security < 3.2.5 Cross-Site Scripting
CVE-2012-4263 - 6.5iThemes Security <= 4.6.12 Stored Cross-Site Scripting
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C