CVE-2023-3249: Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-3249?
CVE-2023-3249 is a vulnerability in the Web3 - Crypto wallet Login & NFT token gating plugin for WordPress that allows an attacker to bypass authentication and log in as any user.
What is the severity of CVE-2023-3249?
CVE-2023-3249 has a severity rating of critical with a score of 9.8 out of 10.
How does CVE-2023-3249 work?
CVE-2023-3249 works by exploiting incorrect authentication checking in the 'hidden_form_data' function of the Web3 plugin, allowing authenticated attackers to bypass authentication and gain unauthorized access.
Which versions of the Web3 plugin for WordPress are affected by CVE-2023-3249?
Versions up to and including 2.6.0 of the Web3 - Crypto wallet Login & NFT token gating plugin for WordPress are affected by CVE-2023-3249.
How can I fix CVE-2023-3249?
To fix CVE-2023-3249, update the Web3 - Crypto wallet Login & NFT token gating plugin for WordPress to a version beyond 2.6.0.