WordPress Plugin Vulnerabilities

SiteGround Security < 1.2.6 - Authentication Bypass via 2-FA Authentication Setup

Description

The 2FA functionality of the plugin is insecurely implemented which could allow unauthenticated attackers to gain access to privileged accounts.

Affects Plugins

Plugin icon
sg-security
Fixed in 1.2.6

References

CVE
CVE-2022-0992
URL
https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/

Miscellaneous

Original Researcher
Chloe Chamberland (Wordfence)
Verified
Yes
WPVDB ID
5600f324-3301-4e1a-a9a8-6e97d45cdadc

Timeline

Publicly Published
2022-04-07 (about 4 years ago)
Added
2022-04-07 (about 4 years ago)
Last Updated
2022-04-08 (about 4 years ago)

Other

Published
Title
Published
2019-10-14
Title
WordPress <= 5.2.3 - Unauthenticated View Private/Draft Posts
Published
2014-08-01
Title
WordPress 3.7.1 & 3.8.1 - Privilege Escalation
Published
2020-04-11
Title
Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure
Published
2014-07-16
Title
WP Backitup <= 1.9.1 - Backup File Disclosure
Published
2019-05-19
Title
Option Tree < 2.7.3 - Object Injection Bypass