SB2019092722 - Improper authentication in GiveWP Give – Donation Plugin and Fundraising Platform for WordPress

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019092722

SB2019092722 - Improper authentication in GiveWP Give – Donation Plugin and Fundraising Platform for WordPress

Published: September 27, 2019

Security Bulletin ID SB2019092722
Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper Authentication (CVE-ID: N/A)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in the "get_user()" parameter when it does a check based on the API key that was provided, but doesn’t verify if the key was one generated by the Give API, but rather just fetches the "user_id" for any meta key in the "wp_usermeta" table. A remote attacker can bypass authentication process and gain unauthorized access to personally identifiable user information (PII), such as names, addresses, IP addresses, and email addresses.


Remediation

Install update from vendor's website.

References