CVE-2023-5089

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

Medium · published October 16, 2023

CVSS v3.1
5.3
EPSS
2%
Percentile
84.4
In the wild
Unconfirmed
What it is

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.02473 · 84.4th percentile
Published
2023-10-16T19:39Z
EPSS history
Timeline
  • 16 OCT 19:39Z
    Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
    cvelistv5