CVE-2024-6641
Getastra Wp Hardening ≤ 1.2.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NSummary
CVE-2024-6641 is a medium-severity Incorrect Regular Expression (CWE-185) vulnerability in Getastra Wp Hardening. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Obfuscated Files or Information (T1027); ranked at the 31th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-47699
Vulnerability Data
The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration"…
more
feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover regex that fails to match or compare data as intended.
A reference monitor must be small and correct, structurally limiting the chance of flawed comparison logic in authorization decisions.
Requiring documented development standards and tools reduces the chance that incorrect regular expressions are written into validation or filtering logic.
An SDLC that incorporates security can embed reviews or tooling that catch malformed regular expressions before deployment.
Security engineering principles require correct implementation of comparison logic used for access and authentication decisions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require correct regex design, testing, and review to avoid improper matching.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect regex-related flaws before release.
Secure development lifecycle includes validation of input-handling constructs such as regex.
Application security requirements can mandate correct regex design and testing.
Secure architecture principles can require robust comparison mechanisms for access decisions.
Secure coding standards directly address proper construction and review of regular expressions.
Secure authentication mechanisms rely on correct comparison of credentials or tokens.