Siteground Security
Monthly
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Authentication bypass in the SiteGround Security WordPress plugin (versions ≤ 1.6.6) enables unauthenticated remote attackers to circumvent two-factor authentication protections and obtain fully authenticated WordPress sessions. Classified as CWE-290 (Authentication Bypass by Spoofing), this network-exploitable flaw carries a CVSS 8.1 score with full high impact across confidentiality, integrity, and availability, moderated only by elevated attack complexity (AC:H). No public exploit code or CISA KEV listing has been identified at time of analysis.
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.