miniOrange's Google Authenticator <= 5.5.82 - Missing Authorization

miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on an the mo_wpns_malware_redirect function in versions up to, and including, 5.5.82. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to initiate/terminate malware scans or obtain the malware scan status of a currently ongoing or the last scan. Terminating ongoing scans could aid an attacker who is attempting to infect a site, while repeatedly initiating new scans could lead to resource exhaustion. Additionally, knowing the status of the last scan might help an attacker who wishes to further compromise a site or server.

Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: miniOrange 2FA 5.6.0 closes this, and updating the plugin is the step that ends it.

• Login Security
• Alerts