CVE-2024-6641: 
WordPress vulnerability analysis and mitigation

The WP Hardening – Fix Your WordPress Security plugin for WordPress contains a Security Feature Bypass vulnerability (CVE-2024-6641) affecting all versions up to and including 1.2.6. The vulnerability was discovered and reported by Wordfence, with the initial disclosure made on September 18, 2024 (NVD).

The vulnerability stems from an incorrect regular expression implementation within the plugin's "Stop User Enumeration" feature. This security flaw has been assigned a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. The issue is classified under CWE-185 (Incorrect Regular Expression) and CWE-697 (Incorrect Comparison) (NVD).

The vulnerability allows unauthenticated attackers to bypass intended security restrictions and expose site usernames. This exposure of usernames could potentially be used as a stepping stone for further attacks, such as targeted brute force attempts or social engineering (NVD).

A patch has been released to address this vulnerability. Users are advised to update their WP Hardening – Fix Your WordPress Security plugin to version 1.2.7 or later (WordPress Patch).