Vulnity Security
Monthly
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.
Vulnity Security, a WordPress plugin maintained by Manuel Galan, can be bypassed to gain administrator access on Nginx-based installations running version 1.4.3 or earlier. The plugin's delegated-login feature writes a pairing credential file and auto-generates an Nginx configuration snippet intended to block web access to it, but the snippet guards the wrong directory path, leaving the credential file reachable by unauthenticated attackers who can then forge signed REST API requests and authenticate as an administrator. No public exploit code or confirmed active exploitation was identified at time of analysis, but the attack requires no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1), with High complexity arising from the dependency on a qualifying Nginx deployment where the delegated-login pairing credential exists and the flawed snippet is active; Apache and other web servers appear unaffected.