Wip Custom Login Vulnerabilities

[en] Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7.

Affected:

up to 1.2.8

Fixed in:

1.2.8

Disclosed:

Jan 17, 2024

CVE-2022-42884 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in ThemeinProgress WIP Custom Login plugin <= 1.2.9 versions.

Affected:

up to 1.3.0

Fixed in:

1.3.0

Disclosed:

May 28, 2023

CVE-2023-33313 on NVD →

The WIP Custom Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.9. This is due to missing or incorrect nonce validation on the 'save_option' function. This makes it possible for unauthenticated attackers to modify the plugin's settings via a forged request gra...

CVSS:

6.5

Affected:

up to 1.2.9

Fixed in:

1.3.0

Disclosed:

May 22, 2023

CVE-2023-33313 on NVD →

The WIP Custom Login plugin for WordPress is vulnerable to authorization bypass due to a missing capability and nonce check on several the wip_custom_login_backup_reset action in versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inv...

CVSS:

6.5

Affected:

up to 1.2.7

Fixed in:

1.2.8

Disclosed:

Oct 24, 2022

CVE-2022-42884 on NVD →