CVE-2023-3249

Name of the Vulnerable Software and Affected Versions Web3 – Crypto wallet Login & NFT token gating plugin for WordPress versions up to, and including, 2.6.0

Description The issue is related to incorrect authentication checking in the hidden form data function, allowing authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Recommendations For versions up to, and including, 2.6.0, consider disabling the hidden form data function until a patch is available to prevent exploitation. Restrict access to sensitive areas of the site to minimize the risk of unauthorized access.