CVE-2023-52147: 
WordPress vulnerability analysis and mitigation

The All-In-One Security (AIOS) – Security and Firewall plugin for WordPress contains a vulnerability (CVE-2023-52147) that affects versions up to and including 5.2.4. The vulnerability is related to the exposure of sensitive information to unauthorized actors, specifically allowing access to functionality not properly constrained by ACLs. The issue was discovered by researcher Naveen Muthusamy and was publicly disclosed on October 25, 2023 (WPScan).

The vulnerability is classified as an Exposure of Sensitive Information to an Unauthorized Actor (CWE-200). It received a CVSS v3.1 Base Score of 3.7 (LOW) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability specifically allows unauthenticated attackers to bypass protection on the login page in cases where it has been renamed by using URL Encoding to visit wp-login.php (Patchstack).

The vulnerability allows unauthorized actors to access the login page even when it has been deliberately renamed for security purposes. This bypass could potentially expose the WordPress login interface to unauthorized users, compromising the security measure of hiding the login page (WPScan).

The vulnerability can be exploited by unauthenticated attackers who can bypass the login page protection using URL encoding techniques. The attack complexity is considered high (AC:H), but requires no privileges (PR:N) or user interaction (UI:N) to execute (Patchstack).

The vulnerability has been fixed in version 5.2.5 of the All-In-One Security (AIOS) plugin. Users are advised to update to version 5.2.5 or later to remove the vulnerability (Patchstack).