.. / CVE-2023-5089

• Auth Bypass
• Nuclei
• Web

Exploit for Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page) (CVE-2023-5089)

Description:

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

Nuclei Template

View the template here CVE-2023-5089.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2023/CVE-2023-5089.yaml

References: