Description

WordPress Plugin Simple JWT Login-Login and Register to WordPress using JWT is using the str_shuffle PHP function to generate user passwords, that "does not generate cryptographically secure values, and should not be used for cryptographic purposes" according to PHP's documentation. WordPress Plugin Simple JWT Login-Login and Register to WordPress using JWT version 3.2.1 is vulnerable; prior versions may also be affected.

Remediation

Update to plugin version 3.3.0 or latest

References

https://plugins.trac.wordpress.org/changeset/2613782

Related Vulnerabilities

WordPress Plugin Free WordPress To Display Like/Dislike Comment Rating-Everest Comment Rating Lite includes Backdoor [Only if downloaded via the vendor website] (2.0.4)

ZenCart Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2008-6985)

Grafana Improper Synchronization Vulnerability (CVE-2023-2801)

OpenSSL Out-of-bounds Write Vulnerability (CVE-2016-6303)

WordPress Plugin Ultimate Addons for Elementor Security Bypass (1.24.1)

Severity

High

Classification

CVE-2021-24998 CWE-326 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update