What is CVE-2023-6036?

CVE-2023-6036 is a critical-severity vulnerability in Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2024-02-12.

How severe is CVE-2023-6036?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Is CVE-2023-6036 known to be exploited?

5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Auth bypass in Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating

CVE-2023-6036

The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Vulnerability class: Broken Access Control

EPSS: 0.018 (75.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Miniorange Web3_-_crypto_wallet_login_\&_nft_token_gating
Unknown Web3 — versions 0

Weakness classification (CWE)

CWE-863 — Incorrect Authorization

Public proof-of-concept exploits

References

contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)

Frequently asked questions

What is CVE-2023-6036?: CVE-2023-6036 is a critical-severity vulnerability in Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2024-02-12.
How severe is CVE-2023-6036?: Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2023-6036 known to be exploited?: 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.