CVE-2023-3249 Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass
Authenticated attackers can bypass authentication to log in as any existing user, including administrators, by exploiting incorrect checks in the Web3 WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-3249?
CVE-2023-3249 is a critical authentication bypass vulnerability in cyberlord92 Web3 – Crypto wallet Login & NFT token gating, published on 30 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Weakness: CWE-288
Which versions are affected by CVE-2023-3249?
It affects 1 product.
Products include Miniorange Web3 - Crypto Wallet Login \& Nft Token Gating.
How do I fix CVE-2023-3249?
No fix has been published for CVE-2023-3249 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2023-3249 being exploited?
There is no known exploitation of CVE-2023-3249 in the wild and no public exploit code.
Other vulnerabilities in cyberlord92 Web3 – Crypto wallet Login & NFT token gating
Sources
Also known as GHSA-24jj-j75x-h48w.