WordPress miniOrange's Google Authenticator Plugin <= 5.6.1 is vulnerable to Sensitive Data Exposure
CVE-2022-44589

8.1HIGH

Key Information:

Vendor
Wordpress
Status
miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login
Vendor
CVE Published:
29 December 2023

Summary

The miniOrange Google Authenticator plugin for WordPress contains a significant vulnerability that allows unauthorized access to sensitive information. This exposure can occur in versions from n/a to 5.6.1, potentially compromising user data and security. Users of this plugin should take immediate action to secure their accounts and ensure that they are running the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login <= 5.6.1

References

https://patchstack.com/database/vulnerability/miniorange-...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Calvin Alkan (Patchstack Alliance)
.