CVE-2023-2706

CVSS V2 None CVSS V3 None
Description
The OTP Login Woocommerce & Gravity Forms plugin for WordPress is vulnerable to authentication bypass. This is due to the fact that when generating OTP codes for users to use in order to login via phone number, the plugin returns these codes in an AJAX response. This makes it possible for unauthenticated attackers to obtain login codes for administrators. This does require an attacker have access to the phone number configured for an account, which can be obtained via social engineering or reconnaissance.
Overview
  • CVE ID
  • CVE-2023-2706
  • Assigner
  • security@wordfence.com
  • Vulnerability Status
  • Received
  • Published Version
  • 2023-05-17T02:15:11
  • Last Modified Date
  • 2023-05-17T02:15:11
Weakness Enumerations
CWE URL
CWE-287 http://cwe.mitre.org/data/definitions/287.html
References
Reference URL Reference Tags
https://plugins.trac.wordpress.org/browser/mobile-login-woocommerce/tags/2.2/includes/class-xoo-ml-verification.php#L362
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2912731%40mobile-login-woocommerce&new=2912731%40mobile-login-woocommerce&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/b1b7b653-496f-467a-9513-4be1891f38ae?source=cve
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-2706
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2706
History
Created Old Value New Value Data Type Notes
2023-05-17 03:00:29 Added to TrackCVE
2023-05-17 03:00:30 Weakness Enumeration new