Login Sign Up

CVE-2023-3249

9.8 CRITICAL
Authentication Bypass

📋 TL;DR

This vulnerability allows authenticated attackers to bypass authentication in the Web3 WordPress plugin and log in as any existing user, including administrators, by exploiting incorrect authentication checking in the 'hidden_form_data' function. All WordPress sites using vulnerable versions of the Web3 plugin are affected.

💻 Affected Systems

Products:
  • Web3 – Crypto wallet Login & NFT token gating plugin for WordPress
Versions: Up to and including 2.6.0
Operating Systems: All
Default Config Vulnerable: ⚠️ Yes
Notes: Requires attacker to have authenticated access and know target username.

📦 What is this software?

Web3 Crypto Wallet Login \& Nft Token Gating by Miniorange

View all CVEs affecting Web3 Crypto Wallet Login \& Nft Token Gating →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers gain administrative access to WordPress sites, enabling complete site takeover, data theft, malware installation, and defacement.

🟠

Likely Case

Attackers compromise user accounts, steal sensitive data, and potentially escalate privileges to administrative access.

🟢

If Mitigated

With proper access controls and monitoring, impact is limited to unauthorized access attempts that can be detected and blocked.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: LIKELY
Unauthenticated Exploit: ✅ No
Complexity: LOW

Exploitation requires authenticated access and knowledge of target username.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 2.6.1 or later

Vendor Advisory: https://plugins.trac.wordpress.org/browser/web3-authentication

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Web3 – Crypto wallet Login & NFT token gating' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 2.6.1+ from WordPress repository and replace plugin files.

🔧 Temporary Workarounds

Disable Web3 Plugin

all

Temporarily disable the vulnerable plugin until patched.

wp plugin deactivate web3-authentication

Restrict User Enumeration

all

Prevent username discovery through login errors and author archives.

Add to wp-config.php: define('WP_HIDE_LOGIN_ERRORS', true);

🧯 If You Can't Patch

  • Implement strong network segmentation and firewall rules to limit access to WordPress admin interface.
  • Enable multi-factor authentication for all user accounts, especially administrators.

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel > Plugins > Installed Plugins for 'Web3 – Crypto wallet Login & NFT token gating' plugin version 2.6.0 or earlier.

Check Version:

wp plugin get web3-authentication --field=version

Verify Fix Applied:

Verify plugin version is 2.6.1 or later in WordPress admin panel > Plugins > Installed Plugins.

📡 Detection & Monitoring

Log Indicators:

  • Unusual login patterns, multiple failed/successful login attempts for different users from same IP, admin login from unexpected locations

Network Indicators:

  • HTTP POST requests to /wp-admin/admin-ajax.php with 'action' parameter containing 'web3' or 'moweb3'

SIEM Query:

source="wordpress.log" AND ("web3" OR "moweb3") AND ("login" OR "authentication")

📊 Metadata

CVE ID: CVE-2023-3249
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: June 30, 2023
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON