CVE-2023-3249
Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.
| CWE | CWE-288 |
| Vendor | cyberlord92 |
| Product | web3 – crypto wallet login & nft token gating |
| Published | Jun 30, 2023 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for cyberlord92 web3 – crypto wallet login & nft token gating
Be the first to know when new critical vulnerabilities affecting cyberlord92 web3 – crypto wallet login & nft token gating are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
cyberlord92 / Web3 – Crypto wallet Login & NFT token gating
0 ≤ 2.6.0
References
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/e30b62de-7280-4c29-b882-dfa83e65966b?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/web3-authentication/tags/2.6.0/classes/common/Web3/controller/class-moweb3flowhandler.php#L198 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/2933325/
Credits
István Márton