Wurdey WordPress plugin admin login bypass
WordPress site admin accounts can be taken over without a password!
Summary
The Wurdey WordPress plugin does not verify a request signature before logging a user in. An unauthenticated attacker who knows only the administrator's username can log in as administrator. Versions through 1.0.0 are affected.
What to do
No fixed version is known. If you use this plugin, remove it or check the vendor advisory.
Products and platforms
CVE IDs
Sources
- Write-up: wpscan.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen