WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability
CVE-2021-36917

6.5MEDIUM

Key Information:

Vendor
Wordpress
Status
Hide My WP (WordPress Plugin)
Vendor
CVE Published:
24 November 2021

Summary

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.

Affected Version(s)

Hide My WP (WordPress plugin) <= 6.2.3 <= 6.2.3

References

https://codecanyon.net/item/hide-my-wp-amazing-security-p...
x_refsource_CONFIRM
https://patchstack.com/hide-my-wp-vulnerabilities-fixed/
x_refsource_MISC
https://patchstack.com/database/vulnerability/hide-my-wp/...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Vulnerability discovered by Dave Jong (Patchstack).
.