Lws Hide Login Vulnerabilities

The LWS Hide Login plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 2.1.8. This is due to the fact that attackers can bypass the hidden login page by visiting install.php. This makes it possible for unauthenticated attackers to login to the site even when the login...

CVSS:

5.3

Affected:

up to 2.1.8

Fixed in:

2.1.9

Disclosed:

Nov 16, 2023

CVE-2023-47818 on NVD →

The LWS Hide Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.6. This is due to missing nonce validation on several of its functions such as lws_hl_create_page() and lws_hl_create_page_network(). This makes it possible for unauthenticated attackers to invoke t...

CVSS:

4.3

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

May 31, 2023

CVE-2023-34025 on NVD →

Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...

CVSS:

8.8

Affected:

up to 2.0.2

Fixed in:

2.1

Disclosed:

Dec 12, 2022