CVE-2023-28786 WordPress Solid Security Plugin <= 8.1.4 is vulnerable to Open Redirection
Attackers can redirect users to malicious sites via the Solid Security plugin, potentially facilitating phishing attacks against WordPress users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28786?
CVE-2023-28786 is a low-severity vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection, published on 29 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection.This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.
Weakness: CWE-601
Which versions are affected by CVE-2023-28786?
It affects 1 product.
Products include Solidwp Solid Security.
How do I fix CVE-2023-28786?
No fix has been published for CVE-2023-28786 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-28786 being exploited?
There is no known exploitation of CVE-2023-28786 in the wild and no public exploit code.
Other vulnerabilities in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection
Sources
Also known as GHSA-7c75-vj46-9946.