Auth bypass in Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating
CVE-2023-6036
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handle_auth_request' and 'hadle_login_request'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.018 (77.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 77th percentile — 77.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.018 · newest: 0.018 · change: 0.000
Affected products
- Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating
- Web3 — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- wpscan.com/vulnerability/7f30ab20-805b-422c-a9a5-21d39c570ee4/ (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2023-6036?
- CVE-2023-6036 is a critical-severity vulnerability in Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating, classified under Incorrect Authorization. CVSS score: 9.8/10. Published 2024-02-12.
- How severe is CVE-2023-6036?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2023-6036 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.