SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure

mediumseverity

1.2%likelihood of exploitation, next 30 days

68%of all CVEs are less likely

Readycheck to confirm it

The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.

Impact

Unauthenticated attackers can discover the actual login page URL despite protection mechanisms, facilitating brute force attacks or targeted exploitation of the WordPress login interface.

Fix

Upgrade to SiteGuard WP Plugin version 1.7.7 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/siteguard/readme.txt
Positive when: status_code == 200 and contains(body, "SiteGuard WP Plugin")
Send: GET {{BaseURL}}/wp-register.php
Positive when: status_code == 301 || status_code == 302 and !contains(tolower(location), 'wp-login.php') and !contains(tolower(location), 'wp-register.php') and !contains(tolower(location), 'notfound') and !contain…

Run it with nuclei: nuclei -id CVE-2024-37881 -u <target>

The full check

id: CVE-2024-37881

info:
  name: SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure
  author: s4e-io
  severity: medium
  description: |
    The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attackers to gain access to the login page.
  impact: |
    Unauthenticated attackers can discover the actual login page URL despite protection mechanisms, facilitating brute force attacks or targeted exploitation of the WordPress login interface.
  remediation: |
    Upgrade to SiteGuard WP Plugin version 1.7.7 or later.
  reference:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37881
    - https://jvn.jp/en/jp/JVN60331535/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/siteguard/siteguard-wp-plugin-176-login-page-disclosure
    - https://www.usom.gov.tr/bildirim/tr-24-0726
  classification:
    epss-score: 0.01184
    epss-percentile: 0.6804
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/siteguard/"
  tags: cve,cve2024,siteguard,wp-plugin,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/siteguard/readme.txt"

    matchers:
      - type: dsl
        internal: true
        dsl:
          - "status_code == 200"
          - 'contains(body, "SiteGuard WP Plugin")'
        condition: and

  - method: GET
    path:
      - "{{BaseURL}}/wp-register.php"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 301 || status_code == 302"
          - "!contains(tolower(location), 'wp-login.php')"
          - "!contains(tolower(location), 'wp-register.php')"
          - "!contains(tolower(location), 'notfound')"
          - "!contains(tolower(location), 'not-found')"
          - "!contains(tolower(location), '/404')"
        condition: and

    extractors:
      - type: kval
        kval:
          - location

References

Use this check only on systems you are authorised to test. Where the data comes from