Change WP Admin Login <= 1.1.3 - Protection Mechanism Failure to Login Page Disclosure
Strategic Overview
- Status
- Patched in 1.1.4
- Affected Version
<= 1.1.3- CVSS
- 5.3Medium
- Weakness type
- CWE-693 · Protection Mechanism Failure
- CVE
CVE-2023-3604
At a glance
CVE-2023-3604 is a medium-severity Protection Mechanism Failure vulnerability in the All In One Login WordPress plugin, affecting versions <= 1.1.3. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.1.4; sites on affected versions should update now. Disclosed July 2023, reported by Muhamad Arsyad.
Vulnerability Overview
The Change WP Admin Login plugin for WordPress is vulnerable to Protection Mechanism Failure in versions up to, and including, 1.1.3 via the 'filter_wp_login_php' function. This can allow unauthenticated attackers to find the URL of the login page even after it has been hidden by the plugin's functionality.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-693: Protection Mechanism Failure
The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Remediation
Update to version 1.1.4, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: All In One Login 1.1.4 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Same weakness class
Other vulnerabilities in All In One Login — Login Page Security and Customization for WordPress with Google reCAPTCHA, Social Login, Temporary Login, 2FA, and more.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C