miniOrange Vulnerabilities and Affected Products
Vulnerabilities associated with Malware Scanner plugin and Web Application Firewall plugin for WordPress.
Products
Clear product- WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn)5 vulnerabilities
- miniorange otp verification4 vulnerabilities
- WordPress Social Login and Register3 vulnerabilities
- Custom API for WP2 vulnerabilities
- Headless Single Sign On2 vulnerabilities
- Malware Scanner2 vulnerabilities
- miniOrange Discord Integration2 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)2 vulnerabilities
- otp_verification2 vulnerabilities
- SAML SP Single Sign On2 vulnerabilities
- web_application_firewall2 vulnerabilities
- wordpress_social_login_and_register_\(discord\,_google\,_twitter\,_linkedin\)2 vulnerabilities
- Backup and Restore1 vulnerability
- LDAP Integration with Active Directory and OpenLDAP - NTLM & Kerberos Login1 vulnerability
- Malware Scanner plugin and Web Application Firewall plugin for WordPress1 vulnerability
- malware_scanner1 vulnerability
- miniOrange WordPress SAML SSO Premium1 vulnerability
- miniOrange WordPress SAML SSO Premium MulsiteSite1 vulnerability
- miniOrange WordPress SAML SSO Standard1 vulnerability
- miniOrange's Google Authenticator1 vulnerability
- miniOrange's Google Authenticator (WordPress plugin)1 vulnerability
- miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login1 vulnerability
- OAuth 2.0 client for SSO (WordPress plugin)1 vulnerability
- OAuth Single Sign On Enterprise1 vulnerability
- OAuth Single Sign On Free1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-2172CRITICAL | Malware Scanner <= 4.7.2 and Web Application Firewall <= 2.1.1 - Unauthenticated Privilege EscalationThe Malware Scanner plugin and the Web Application Firewall plugin for WordPress (both by MiniOrange) are vulnerable to privilege escalation due to a missing capability check on the mo_wpns_init() function in all versions up to, and including, 4.7.2 (for Malware Scanner) and 2.1.1 (for Web Application Firewall). This makes it possible for unauthenticated attackers to escalate their privileges to that of an administrator. CWE-304Mar 13, 2024 | CVSS9.8v3.1 | EPSS1.71% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |