CVE-2023-3249
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk55th percentile - higher than 55% of all known CVEs
Summary
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to and including 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function.
Risk Assessment
The risk is that authenticated attackers can log in as any existing user on the site, including an administrator, if they have access to the username.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability. Additionally, monitor access logs for potential unauthorized login attempts.
Original NVD description (English source)
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.