CVE-2023-5089

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page)

State: Published
Severity: 5.3 Medium
Published: Oct 16, 2023
Updated: Apr 23, 2025
Reserved: Sep 20, 2023

Description

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
Defender SecurityUnknown	before 4.1.0Affected

References

https://wpscan.com/vulnerability/2b547488-187b-44bc-a57d-f876a7d4c87dexploitvdb-entrytechnical-description
https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.