CVE-2024-6641
WP Hardening – Fix Your WordPress Security <= 1.2.6 - Unauthenticated Security Feature Bypass to Username Enumeration
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 18, 2024
- Updated
- Apr 8, 2026
- Reserved
- Jul 10, 2024
Description
The WP Hardening – Fix Your WordPress Security plugin for WordPress is vulnerable to Security Feature Bypass in all versions up to, and including, 1.2.6. This is due to use of an incorrect regular expression within the "Stop User Enumeration" feature. This makes it possible for unauthenticated attackers to bypass intended security restrictions and expose site usernames.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | Wordfence |
Weaknesses
- CWE-185 Incorrect Regular Expression
Affected Products
| Product | Versions |
|---|---|
WP Hardening (discontinued)astrasecuritysuite |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.