The ZM Ajax Login & Register plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.0.2. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
References
Configurations
Configuration 1 (hide)
|
History
24 Apr 2023, 17:57
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Zm Ajax Login \& Register Project zm Ajax Login \& Register
Zm Ajax Login \& Register Project |
|
| CWE | CWE-287 | |
| CPE | cpe:2.3:a:zm_ajax_login_\&_register_project:zm_ajax_login_\&_register:*:*:*:*:*:wordpress:*:* | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/b10d01ec-54ef-456b-9410-ed013343a962?source=cve - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/browser/zm-ajax-login-register/trunk/src/ALRSocial/ALRSocialFacebook.php#L58 - Broken Link |
15 Apr 2023, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-04-15 08:15
Updated : 2023-11-07 04:11
NVD link : CVE-2023-2027
Mitre link : CVE-2023-2027
JSON object : View
Products Affected
zm_ajax_login_\&_register_project
- zm_ajax_login_\&_register
CWE
CWE-287
Improper Authentication