Vulnerabilities > CVE-2020-36176 - Incorrect Authorization vulnerability in Ithemes Security

CVSS 5.0 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

PARTIAL

Availability impact

NONE

network

low complexity

ithemes

CWE-863

NVD

Published: 2021-01-06

Updated: 2021-07-21

Summary

The iThemes Security (formerly Better WP Security) plugin before 7.7.0 for WordPress does not enforce a new-password requirement for an existing account until the second login occurs.

Vulnerable Configurations

Part	Description	Count
Application	Ithemes Ithemes Ithemes Security - Ithemes Ithemes Security 5.0.1 Ithemes Ithemes Security 5.1.1 Ithemes Ithemes Security 5.2.1 Ithemes Ithemes Security 5.3.7 Ithemes Ithemes Security 5.4.5 Ithemes Ithemes Security 5.5.0 Ithemes Ithemes Security 5.6.0 Ithemes Ithemes Security 5.6.1 Ithemes Ithemes Security 5.6.2 Ithemes Ithemes Security 5.6.3 Ithemes Ithemes Security 5.6.4 Ithemes Ithemes Security 5.7.0 Ithemes Ithemes Security 5.7.1 Ithemes Ithemes Security 5.8.0 Ithemes Ithemes Security 5.8.1 Ithemes Ithemes Security 5.9.0 Ithemes Ithemes Security 6.0.0 Ithemes Ithemes Security 6.1.0 Ithemes Ithemes Security 6.1.1 Ithemes Ithemes Security 6.2.0 Ithemes Ithemes Security 6.2.1 Ithemes Ithemes Security 6.3.0 Ithemes Ithemes Security 6.4.0 Ithemes Ithemes Security 6.5.0 Ithemes Ithemes Security 6.5.1 Ithemes Ithemes Security 6.6.0 Ithemes Ithemes Security 6.6.1 Ithemes Ithemes Security 6.7.0 Ithemes Ithemes Security 6.8.0 Ithemes Ithemes Security 6.8.1 Ithemes Ithemes Security 6.9.0 Ithemes Ithemes Security 6.9.1 Ithemes Ithemes Security 6.9.2 Ithemes Ithemes Security 7.0.1 Ithemes Ithemes Security 7.0.2 Ithemes Ithemes Security 7.0.3 Ithemes Ithemes Security 7.0.4 Ithemes Ithemes Security 7.1.0 Ithemes Ithemes Security 7.2.0 Ithemes Ithemes Security 7.3.0 Ithemes Ithemes Security 7.3.1 Ithemes Ithemes Security 7.3.2 Ithemes Ithemes Security 7.3.3 Ithemes Ithemes Security 7.4.0 Ithemes Ithemes Security 7.4.1 Ithemes Ithemes Security 7.5.0 Ithemes Ithemes Security 7.6.0 Ithemes Ithemes Security 7.6.1	49

Common Weakness Enumeration (CWE)

CWE-863 - Incorrect Authorization

References

https://wordpress.org/plugins/better-wp-security/#developers