CVE-2023-3604

Change WP Admin Login <= 1.1.3 - Protection Mechanism Failure to Login Page Disclosure

2023-07-27 00:00
Muhamad Arsyad

At a glance

CVE-2023-3604 is a medium-severity Protection Mechanism Failure vulnerability in the All In One Login WordPress plugin, affecting versions <= 1.1.3. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.1.4; sites on affected versions should update now. Disclosed July 2023, reported by Muhamad Arsyad.

Vulnerability Overview

The Change WP Admin Login plugin for WordPress is vulnerable to Protection Mechanism Failure in versions up to, and including, 1.1.3 via the 'filter_wp_login_php' function. This can allow unauthenticated attackers to find the URL of the login page even after it has been hidden by the plugin's functionality.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-693: Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Remediation

Update to version 1.1.4, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: All In One Login 1.1.4 closes this, and updating the plugin is the step that ends it.

  • Alerts

External References

Related records

Other vulnerabilities in All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C