Main Vulnerability Database Vulnerabilities #VU58494

Improper access control in Hide My WP - CVE-2021-36917

Published: December 2, 2021

Vulnerability identifier: #VU58494

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-36917

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions within a reset token. A remote attacker can deactivated the plugin and perform a denial of service (DoS) attack.

Affected software

Hide My WP

How to mitigate CVE-2021-36917

Install updates from vendor's website.

Hide My WP - update to 6.2.4

External References

https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability
https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158
https://patchstack.com/hide-my-wp-vulnerabilities-fixed/

Related Security Bulletins