CVE-2023-3404: ProfileGrid <= 5.5.0 - Hardcoded Encryption Key
The ProfileGrid plugin for WordPress is vulnerable to unauthorized decryption of private information in versions up to, and including, 5.5.0. This is due to the passphrase and iv being hardcoded in the 'pmencryptdecryptpass' function and used across all sites running the plugin. This makes it possible for authenticated attackers, with administrator-level permissions or above to decrypt and view users' passwords. If combined with another vulnerability, this can potentially grant lower-privileged users access to users' passwords.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-3404?
CVE-2023-3404 is a vulnerability in the ProfileGrid plugin for WordPress that allows unauthorized decryption of private information.
What is the severity of CVE-2023-3404?
The severity of CVE-2023-3404 is medium with a severity value of 4.9.
Which version of the ProfileGrid plugin for WordPress is affected?
Versions up to and including 5.5.0 of the ProfileGrid plugin for WordPress are affected.
How does CVE-2023-3404 work?
CVE-2023-3404 works by using hardcoded passphrase and iv in the 'pm_encrypt_decrypt_pass' function, which can be exploited to decrypt private information.
How can I fix CVE-2023-3404?
To fix CVE-2023-3404, update the ProfileGrid plugin to a version higher than 5.5.0.