The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation.
References
| Link | Resource |
|---|---|
| https://wpscan.com/vulnerability/1cca404e-766a-43ab-b41f-77d6a3b282fb | Third Party Advisory |
| https://plugins.trac.wordpress.org/changeset/2613782 | Patch Third Party Advisory |
Configurations
History
07 Nov 2023, 03:31
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
04 Jul 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | The Simple JWT Login WordPress plugin before 3.3.0 can be used to create new WordPress user accounts with a randomly generated password. The password is generated using the str_shuffle PHP function that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation. |
30 Jun 2023, 18:08
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-330 |
Information
Published : 2021-12-27 11:15
Updated : 2023-11-07 03:31
NVD link : CVE-2021-24998
Mitre link : CVE-2021-24998
JSON object : View
Products Affected
simple_jwt_login_project
- simple_jwt_login
CWE
No CWE.