CVE-2023-3249 - Web3 – Crypto wallet Login & NFT token gating <= 2.6.0

Back Back to CVE browser

CRITICAL

Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass

Published Jun 30, 2023

9.8

CRITICAL

CVSS 3.1

EPSS 1.10%

Description

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Affected products

Vendor Cyberlord92 Product Web3 – Crypto wallet Login & NFT token gating Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=2.6.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cyberlord92

Web3 – Crypto wallet Login & NFT token gating

unaffected

Version	Status	Constraints
-	affected	<=2.6.0

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-288

References (4)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-43925		Advisory
https://plugins.trac.wordpress.org/browser/web3-authentication/tags/2.6.0/classes/common/Web3/controller/class-moweb3flowhandler.php#L198		Patch
https://plugins.trac.wordpress.org/changeset/2933325/
https://www.wordfence.com/threat-intel/vulnerabilities/id/e30b62de-7280-4c29-b882-dfa83e65966b?source=cve		Third Party Advisory