CVE-2021-36917 - OpenCVE

WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

AV:N/AC:L/Au:N/C:N/I:N/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wpwave	Hide My Wp

Configuration 1 [-]

cpe:2.3:a:wpwave:hide_my_wp:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158
https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability
https://patchstack.com/hide-my-wp-vulnerabilities-fixed/

History

No history.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2021-11-24T16:19:08.984175Z

Updated: 2024-09-16T21:07:22.039Z

Reserved: 2021-07-19T00:00:00

Link: CVE-2021-36917

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-11-24T17:15:07.917

Modified: 2022-10-27T17:00:10.550

Link: CVE-2021-36917

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Hide My WP (WordPress plugin)", "vendor": "wpWave", "versions": [{"lessThanOrEqual": "6.2.3", "status": "affected", "version": "<= 6.2.3", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Vulnerability discovered by Dave Jong (Patchstack)."}], "datePublic": "2021-11-24T00:00:00", "descriptions": [{"lang": "en", "value": "WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-284", "description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-11-24T16:19:08", "orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158"}, {"tags": ["x_refsource_MISC"], "url": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed/"}, {"tags": ["x_refsource_MISC"], "url": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability"}], "solutions": [{"lang": "en", "value": "Update to 6.2.4 or higher version."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "audit@patchstack.com", "DATE_PUBLIC": "2021-11-24T14:14:00.000Z", "ID": "CVE-2021-36917", "STATE": "PUBLIC", "TITLE": "WordPress Hide My WP premium plugin <= 6.2.3 - Unauthenticated Plugin Deactivation vulnerability"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Hide My WP (WordPress plugin)", "version": {"version_data": [{"version_affected": "<=", "version_name": "<= 6.2.3", "version_value": "6.2.3"}]}}]}, "vendor_name": "wpWave"}]}}, "credit": [{"lang": "eng", "value": "Vulnerability discovered by Dave Jong (Patchstack)."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-284 Improper Access Control"}]}]}, "references": {"reference_data": [{"name": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158", "refsource": "CONFIRM", "url": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158"}, {"name": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed/", "refsource": "MISC", "url": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed/"}, {"name": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability", "refsource": "MISC", "url": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability"}]}, "solution": [{"lang": "en", "value": "Update to 6.2.4 or higher version."}], "source": {"discovery": "EXTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T01:01:59.663Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed/"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability"}]}]}, "cveMetadata": {"assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "assignerShortName": "Patchstack", "cveId": "CVE-2021-36917", "datePublished": "2021-11-24T16:19:08.984175Z", "dateReserved": "2021-07-19T00:00:00", "dateUpdated": "2024-09-16T21:07:22.039Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpwave:hide_my_wp:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "EE2E78B7-574B-4AFD-9718-CAA0FC5FCC44", "versionEndIncluding": "6.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WordPress Hide My WP plugin (versions <= 6.2.3) can be deactivated by any unauthenticated user. It is possible to retrieve a reset token which can then be used to deactivate the plugin."}, {"lang": "es", "value": "El plugin Hide My WP de WordPress (versiones anteriores a 6.2.3 incluy\u00e9ndola) puede ser deshabilitado por cualquier usuario no autenticado. Es posible recuperar un token de restablecimiento que puede ser usado para deshabilitar el plugin"}], "id": "CVE-2021-36917", "lastModified": "2022-10-27T17:00:10.550", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 2.5, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2021-11-24T17:15:07.917", "references": [{"source": "audit@patchstack.com", "tags": ["Product"], "url": "https://codecanyon.net/item/hide-my-wp-amazing-security-plugin-for-wordpress/4177158"}, {"source": "audit@patchstack.com", "tags": ["Third Party Advisory"], "url": "https://patchstack.com/database/vulnerability/hide-my-wp/wordpress-hide-my-wp-premium-plugin-6-2-3-unauthenticated-plugin-deactivation-vulnerability"}, {"source": "audit@patchstack.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://patchstack.com/hide-my-wp-vulnerabilities-fixed/"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-284"}], "source": "audit@patchstack.com", "type": "Secondary"}]}