Block Wp Login Vulnerabilities

The Block WP Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the 'bwpl_configure_slug()' function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request g...

CVSS:

8.8

Affected:

up to 1.3.0

Fixed in:

1.3.2

Disclosed:

Jun 27, 2019

Cross-Site Request Forgery (CSRF) vulnerability found in WordPress Block wp-login plugin (verions <= 1.3.1).

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

Jun 27, 2019

The Block WP Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing or incorrect nonce validation on the 'bwpl_configure_slug()' function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request g...

Affected:

up to 1.3.2

Fixed in:

1.3.2

Disclosed:

Jun 27, 2019

Lack of CSRF and authorisation checks in the bwpl_configure_slug() function registered as an admin_init action could allow attacker (via CSRF, or unauthenticated using the admin-ajax.php) to change the plugin settings (located at /wp-admin/options-permalink.php) and disable the protection offered. v1.3.1 added a non...

Affected:

up to 1.3.2

Fixed in:

1.3.2