WordPress Plugin Vulnerabilities

WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) < 7.6.5 - Authentication Bypass

Description

The improper credential validation on the plugin allows unauthenticated attackers to escalate privileges if administrator's emails is known.

Affects Plugins

Plugin icon
miniorange-login-openid
Fixed in 7.6.5

References

CVE
CVE-2023-2982

Miscellaneous

Original Researcher
Lana Codes
Verified
No
WPVDB ID
844a4e43-84c7-4d84-b0f5-e6327504150f

Timeline

Publicly Published
2023-06-28 (about 2 years ago)
Added
2023-06-29 (about 2 years ago)
Last Updated
2023-06-29 (about 2 years ago)

Other

Published
Title
Published
2024-02-12
Title
WP Editor < 1.2.8 - Sensitive Information Exposure via log file
Published
2024-10-14
Title
RS-Members <= 1.0.3 - Authenticated (Subscriber+) Privilege Escalation
Published
2014-08-01
Title
Myriad 2.0 - dl-skin.php _mysite_delete_skin_zip Parameter Absolute Path Traversal Remote Directory Deletion
Published
2024-10-14
Title
BuddyPress Better Registration <= 1.6 - Authentication Bypass to Administrator
Published
2013-06-21
Title
WordPress 3.4-3.5.1 DoS in class-phpass.php