CVE-2023-6813: Reflected Cross-Site Scripting in Auth0 WordPress Plugin
Summary
CVE-2023-6813: Login by Auth0 plugin for WordPress vulnerable to Reflected Cross-Site Scripting. Affects auth0/wordpress versions < 4.6.1. Fixed in 4.6.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Auth0 WordPress plugin is a tool that enables site administrators to incorporate Auth0's authentication and authorization services into their WordPress websites. It provides a seamless integration between WordPress and Auth0, allowing users to log in using various identity providers. The plugin offers additional features such as single sign-on, social login, and multi-factor authentication. However, a vulnerability has been discovered in previous versions of the plugin that could potentially lead to a Reflected Cross-Site Scripting (XSS) attack on the WordPress login page.
Vulnerability Detail
The vulnerability arises from the plugin's handling of the 'wle' parameter, which is used as an emergency fallback mechanism for administrators to access their dashboard in case of issues. Under specific conditions, this parameter could accept an arbitrary string that would be improperly rendered, opening the door for a potential XSS attack. An attacker could exploit this vulnerability by crafting a malicious URL that includes a script, which would then be executed when a targeted user visits the compromised login page. This could lead to unauthorized access, data theft, or other malicious activities.
How To Fix
Minimum fixed version
4.6.1
This is the first release that contains the fix.
composer require auth0/wordpress:4.6.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Auth0 WordPress plugin versions up to and including 4.6.0 are vulnerable to a Reflected Cross-Site Scripting (XSS) attack. This could allow attackers to execute malicious scripts on the WordPress login page, potentially leading to unauthorized access or data theft. To address this issue, it is highly recommended to upgrade to version 4.6.1 of the plugin, which includes a fix for this vulnerability.
See every vulnerability recorded for auth0/wordpress →
FAQ
The vulnerability allows for potential cross-site scripting attacks on the WordPress login page, which could lead to unauthorized access, data theft, or other malicious activities.
Versions up to and including 4.6.0 of the Auth0 WordPress plugin are affected by this vulnerability.
To check the version of the Auth0 WordPress plugin, navigate to the WordPress admin dashboard, go to 'Plugins', and locate the Auth0 plugin. The version number should be displayed next to the plugin name.
No, the recommended solution is to upgrade to version 4.6.1 of the Auth0 WordPress plugin.
There is no evidence of active exploits targeting this vulnerability at the moment. However, it is crucial to apply the recommended update to mitigate any potential risks.
Related vulnerabilities
Recent vulnerabilities recorded for auth0/wordpress.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
