CVE-2023-4800
Published: 16 October 2023
Summary
CVE-2023-4800 is a medium-severity an unspecified weakness vulnerability in Wpdo Dologin Security. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The DoLogin Security WordPress plugin before version 3.7.1 contains an access-control flaw that exposes a widget displaying IP addresses of failed login attempts to users with low privileges. The affected component is the plugin's administrative widget, which was not properly restricted despite requiring authentication.
Low-privileged authenticated users can exploit the issue over the network with minimal complexity to retrieve the list of failed-login IPs, resulting in high confidentiality impact without affecting integrity or availability. The CVSS 6.5 rating reflects this remote read exposure under the plugin's default configuration.
WPScan advisories for the vulnerability point to the plugin changelog and recommend updating to version 3.7.1 or later to enforce proper capability checks on the widget. The associated EPSS score rose from a low baseline to a peak of 0.0932, indicating increased exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-54644
Vulnerability details
The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.