Automation Bypass in WordPress Plugin by AAS-N
CVE-2018-15876

5.3MEDIUM

Key Information:

Vendor

Wordpress
Status
Ajax Bootmodal Login
Vendor
CVE Published:
26 August 2018

What is CVE-2018-15876?

An issue has been detected in the ajax-bootmodal-login plugin version 1.4.3 for WordPress that allows an attacker to bypass CAPTCHA protections. The plugin requires users to solve a CAPTCHA only once per session to access the registration, login, and password-recovery forms. This session-based requirement enables automated scripts to send multiple requests without triggering CAPTCHA checks, thereby undermining the security intended to prevent automated submissions.

References

https://github.com/aas-n/CVE/tree/master/ajax-bootmodal-l...
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • Vulnerability published

.