CVE-2024-6641 Vulnerability Details

  /     /     /  

CVE-2024-6641 Metadata Quick Info

CVE Published: 18/09/2024 | CVE Updated: 18/09/2024 | CVE Year: 2024
Source: Wordfence | Vendor: astrasecuritysuite | Product: WP Hardening (discontinued)
Status : PUBLISHED

---

CVE-2024-6641 Description

The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.

Metrics

CVSS Version: 3.1 | Base Score: 5.3 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-185
CWE Name: CWE-185 Incorrect Regular Expression
Source: astrasecuritysuite

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).