QID 150598

Date Published: 2022-11-28

QID 150598: WordPress LoginPress Plugin: Broken Access Control Vulnerability (CVE-2022-41839)

LoginPress Plugin by LoginPress holds a lot of customization fields to change the layout of the login page of WordPress.

Broken Access Control vulnerability in WordPress LoginPress plugin on WordPress leading to unauth changing of Opt-In or Opt-Out tracking settings.

Affected Versions:
WordPress LoginPress Plugin before 1.6.2

QID Detection Logic:
This QID sends a HTTP GET request and checks for vulnerable version of WordPress plugin running on the target application.

Successful exploitation of this vulnerability may allow non-administrators to change Opt-In or Opt-Out tracking settings.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as High - 6.4 severity.

Solution

Customers are advised to upgrade to LoginPress Plugin 1.6.2 or later version to remediate this vulnerability.

Vendor References

Patchstack - patchstack.com/database/vulnerability/loginpress/wordpress-loginpress-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve

CVEs related to QID 150598

CVE-2022-41839 |

Software Advisories

Advisory ID	Software	Component	Link
Patchstack			patchstack.com/database/vulnerability/loginpress/wordpress-loginpress-plugin-1-6-2-broken-access-control-vulnerability?_s_id=cve

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].