Ethpress Web3 Login
Monthly
An authentication bypass in the EthPress - Web3 Login WordPress plugin, affecting all versions up to and including 2.3.5, allows unauthenticated remote attackers to log in as any WordPress user with a linked Ethereum wallet address - including administrators - simply by supplying that user's public wallet address together with an arbitrary, well-formed (but invalid) signature, resulting in full site takeover. The root cause is a missing return statement in verify_login() that lets execution fall through to the cookie-setting login routine even when signature verification fails; no public exploit code has been identified at time of analysis, and the assessment rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the 'high' attack complexity reflecting the need to discover a valid linked wallet address rather than any authentication barrier. Because exploitation is unauthenticated and requires no user interaction, any site where at least one account (especially an administrator) has linked a wallet should be treated as exposed until patched or the plugin is disabled.
An authentication bypass in the EthPress - Web3 Login WordPress plugin, affecting all versions up to and including 2.3.5, allows unauthenticated remote attackers to log in as any WordPress user with a linked Ethereum wallet address - including administrators - simply by supplying that user's public wallet address together with an arbitrary, well-formed (but invalid) signature, resulting in full site takeover. The root cause is a missing return statement in verify_login() that lets execution fall through to the cookie-setting login routine even when signature verification fails; no public exploit code has been identified at time of analysis, and the assessment rates it 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), with the 'high' attack complexity reflecting the need to discover a valid linked wallet address rather than any authentication barrier. Because exploitation is unauthenticated and requires no user interaction, any site where at least one account (especially an administrator) has linked a wallet should be treated as exposed until patched or the plugin is disabled.