CVE-2023-6036: Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass
The Web3 WordPress plugin before 3.0.0 is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6036?
CVE-2023-6036 has been classified as a critical vulnerability due to its potential for unauthorized access.
How do I fix CVE-2023-6036?
To fix CVE-2023-6036, upgrade the Web3 WordPress plugin to version 3.0.0 or later.
Who is affected by CVE-2023-6036?
Users of the Web3 WordPress plugin prior to version 3.0.0 are affected by CVE-2023-6036.
What type of vulnerability is CVE-2023-6036?
CVE-2023-6036 is an authentication bypass vulnerability that allows attackers to log in without proper credentials.
What versions of the Web3 plugin are vulnerable to CVE-2023-6036?
Versions of the Web3 plugin before 3.0.0 are vulnerable to CVE-2023-6036.