Description
The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Defender Security | < 4.1.0 | 4.1.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
Cappricio-Securities/CVE-2023-5089 ★ 1 · May 24, 2024
Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page) http/cves/2023/CVE-2023-5089.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.