Description

WordPress Plugin iThemes Security (formerly Better WP Security) is prone to a security bypass vulnerability. Exploiting this issue may allow attackers to perform otherwise restricted actions and subsequently hide file changes notifications from administrator. WordPress Plugin iThemes Security (formerly Better WP Security) version 5.3.5 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 5.3.6 or latest

References

http://blog.secupress.fr/en/ithemes-security-5-3-6-security-fix-439.html

https://wordpress.org/plugins/better-wp-security/changelog/

Related Vulnerabilities

WordPress Plugin ClickDesk Live Support-Live Chat-Help Desk Cross-Site Scripting (4.2)

WordPress Plugin Conversador Cross-Site Scripting (2.61)

Microsoft SQL Server Other Vulnerability (CVE-2000-1087)

PHP Numeric Errors Vulnerability (CVE-2009-5016)

WordPress Plugin WordPress Download Manager Cross-Site Scripting (2.9.51)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass CWE-264