Strategic Overview
- Status
- Patched in 8.9.3
- Affected Plugin
- WP Cerber Security, Anti-spam & Malware Scan
- Affected Version
< 8.9.3- CVSS
- 9.8Critical
- Weakness type
- CWE-287 · Improper Authentication
- CVE
CVE-2021-37597
At a glance
CVE-2021-37597 is a critical-severity Improper Authentication vulnerability in the WP Cerber Security, Anti-spam & Malware Scan WordPress plugin, affecting versions < 8.9.3. It carries a CVSS score of 9.8 (reachable over the network; low attack complexity; high confidentiality, integrity, availability impact). Exploitation requires no authentication. The issue is fixed in version 8.9.3; sites on affected versions should update now. Disclosed August 2021.
Vulnerability Overview
WP Cerber before 8.9.3 allows MFA bypass via wordpress_logged_in_[hash] manipulation.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user. A successful exploit has high impact on confidentiality, integrity, availability — full site compromise territory.
CWE-287: Improper Authentication
Reaching this weakness in WP Cerber Security, Anti-spam & Malware Scan < 8.9.3 takes a caller who can reach the endpoint. Improper authentication means the mechanism that proves who a caller is can be satisfied without the secret it was supposed to require.
An attacker authenticates as another user — administrators included — without ever knowing a password, so password policies and login rate limits never come into play. For WP Cerber Security, Anti-spam & Malware Scan the fix is 8.9.3: builds < 8.9.3 are affected, anything from 8.9.3 onward is not.
Remediation
Update to version 8.9.3, or a newer patched version
How does WordSec protect against this?
Because it turns on account access, WordSec's login security is the relevant layer: role-based two-factor, captcha and brute-force limits raise the cost of getting the account this needs. None of that substitutes for the fix: WP Cerber Security, Anti-spam & Malware Scan 8.9.3 closes this, and updating the plugin is the step that ends it.
- Login Security
- Alerts
External References
Related records
Other vulnerabilities in WP Cerber Security, Anti-spam & Malware Scan
- 7.2CVE-2022-4712: WP Cerber Security <= 9.1 Stored Cross-Site Scripting
CVE-2022-4712 - 7.2CVE-2022-0429: WP Cerber Security <= 8.9.5.2 Stored XSS
CVE-2022-0429 - 7.2CVE-2016-10990: Cerber Security, Anti-spam & Malware Scan Stored XSS
CVE-2016-10990 - 5.5WP Cerber Security <= 9.0 Stored Cross-Site Scripting
- 5.3CVE-2022-4100: WP Cerber Security <= 9.4 IP Protection Bypass
CVE-2022-4100 - 5.3CVE-2022-4417: WP Cerber Security <= 9.3.2 User Enumeration Bypass
CVE-2022-4417 - 5.3CVE-2022-2939: WP Cerber Security <= 9.0 User Enumeration Bypass
CVE-2022-2939 - 5.3CVE-2021-37598: WP Cerber < 8.9.3 Access Bypass Control
CVE-2021-37598
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C