Loading vulnerability…
Authorization bypass and stored XSS in WordPress Login/Signup Popup
CVE-2020-36715 affects the WordPress Login/Signup Popup plugin through version 1.4. Missing capability checks on several functions allow any authenticated user to inject arbitrary JavaScript into plugin settings through the AJAX API. The vulnerable functionality also lacks a security nonce. The stored scripts can execute when a victim performs a triggering action, such as clicking a crafted link, allowing attackers to target administrators in the WordPress backend.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Authenticated attackers can modify plugin settings without the required authorization and store malicious JavaScript that executes in a victim's browser. Administrators using the WordPress backend can be targeted. Exploitation was reported to have occurred at the time of disclosure.
If you can’t patch tonight, do this now.
Until the plugin is updated, restrict access to the plugin settings to trusted users only. Employ web application firewalls (WAF) to detect and block malicious requests, and educate users to avoid clicking suspicious links.
Patch, then assume compromise.
Upgrade the Login/Signup Popup plugin to version 1.5 or later; version 1.5 fixes the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.