CVE-2023-5089

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

Affected

Defender Security

CVSS v3.1 NVD

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

2.45% chance of exploitation in the next 30 days, 84th percentile

Nuclei

medium

Published

2023-10-16

Updated

2025-04-23

Proof-of-concept exploits (2)

• https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87d
• Cappricio-Securities/CVE-2023-50891★ · 2024-06-24

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-5089.yaml

Security advisories

• https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gr…

References

• CVE Record
• NVD entry

Related

• CVE-2000-0114
• CVE-2009-0347
• CVE-2012-5321
• CVE-2015-1635
• CVE-2015-7297
• CVE-2017-7269