{"vulnerability": "CVE-2023-5089", "sightings": [{"uuid": "e74fc42d-aadf-4259-832f-a9ac0476cda8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50899", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/113623347327078076", "content": "", "creation_timestamp": "2024-12-09T14:31:30.138231Z"}, {"uuid": "3083c59f-732a-4640-9af9-b2bc95153e2c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50897", "type": "seen", "source": "https://gist.github.com/Darkcrai86/aa3fdd2bf9abfdd9a565f0139f415c45", "content": "", "creation_timestamp": "2026-01-05T14:27:40.000000Z"}, {"uuid": "cf0433f1-0862-4137-a643-b4f14cd68608", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50897", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mboul6h5pm2c", "content": "", "creation_timestamp": "2026-01-05T16:34:33.695064Z"}, {"uuid": "9eb89f92-3495-40b6-acd1-6ebeae7c67cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-5089", "type": "seen", "source": "https://t.me/arpsyndicate/4184", "content": "#ExploitObserverAlert\n\nPD/http/cves/2023/CVE-2023-5089\n\nDESCRIPTION: Exploit Observer has 9 entries in 4 file formats related to PD/http/cves/2023/CVE-2023-5089. The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.", "creation_timestamp": "2024-03-13T01:32:06.000000Z"}, {"uuid": "3035c7fb-ac33-4911-a361-71b09a44d786", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-5089", "type": "seen", "source": "https://t.me/cibsecurity/72374", "content": "\u203c CVE-2023-5089 \u203c\n\nThe Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-10-17T00:38:23.000000Z"}, {"uuid": "b8da514a-56a2-4f89-abac-65c2ea31d060", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50896", "type": "seen", "source": "https://t.me/cibsecurity/73938", "content": "\u203c\ufe0fCVE-2023-50896\u203c\ufe0f\n\nImproper Neutralization of Input During Web Page Generation 'Crosssite Scripting' vulnerability in weForms weForms  Easy Drag  Drop Contact Form Builder For WordPress allows Stored XSS.This issue affects weForms  Easy Drag  Drop Contact Form Builder For WordPress from na through 1.6.17.  \n\n\ud83d\udcd6 Read more\n\nVia \"National Vulnerability Database\"", "creation_timestamp": "2023-12-30T01:37:44.000000Z"}, {"uuid": "1c4ba531-28d4-45e2-924e-b8459f4a4c7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50893", "type": "seen", "source": "https://t.me/cibsecurity/73962", "content": "\u203c\ufe0fCVE-2023-50893\u203c\ufe0f\n\nImproper Neutralization of Input During Web Page Generation 'Crosssite Scripting' vulnerability in UpSolution Impreza  WordPress Website and WooCommerce Builder allows Reflected XSS.This issue affects Impreza  WordPress Website and WooCommerce Builder from na through 8.17.4.  \n\n\ud83d\udcd6 Read more\n\nVia \"National Vulnerability Database\"", "creation_timestamp": "2023-12-30T01:39:42.000000Z"}, {"uuid": "5db32d23-2840-4e71-a91f-c37045255ec5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50891", "type": "seen", "source": "https://t.me/cibsecurity/73960", "content": "\u203c\ufe0fCVE-2023-50891\u203c\ufe0f\n\nImproper Neutralization of Input During Web Page Generation 'Crosssite Scripting' vulnerability in Zoho Forms Form plugin for WordPress  Zoho Forms allows Stored XSS.This issue affects Form plugin for WordPress  Zoho Forms from na through 3.0.1.  \n\n\ud83d\udcd6 Read more\n\nVia \"National Vulnerability Database\"", "creation_timestamp": "2023-12-30T01:39:32.000000Z"}, {"uuid": "e912486c-47ec-4697-b07d-ebc8ef61bd8e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50892", "type": "seen", "source": "https://t.me/cibsecurity/73961", "content": "\u203c\ufe0fCVE-2023-50892\u203c\ufe0f\n\nImproper Neutralization of Input During Web Page Generation 'Crosssite Scripting' vulnerability in CodexThemes TheGem  Creative MultiPurpose  WooCommerce WordPress Theme allows Reflected XSS.This issue affects TheGem  Creative MultiPurpose  WooCommerce WordPress Theme from na through 5.9.1.  \n\n\ud83d\udcd6 Read more\n\nVia \"National Vulnerability Database\"", "creation_timestamp": "2023-12-30T01:39:37.000000Z"}, {"uuid": "aef19fa4-2d3f-4d5a-9d56-03047570d391", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50898", "type": "seen", "source": "https://t.me/ctinow/208914", "content": "https://ift.tt/Jj7pYgd\nCVE-2023-50898", "creation_timestamp": "2024-03-15T16:26:30.000000Z"}, {"uuid": "bde2858c-6454-4f60-b45f-09d6e1173eb9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50898", "type": "seen", "source": "https://t.me/ctinow/208904", "content": "https://ift.tt/Jj7pYgd\nCVE-2023-50898", "creation_timestamp": "2024-03-15T16:21:50.000000Z"}, {"uuid": "88178a84-9829-40c1-b6e9-a39b65ae0731", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50893", "type": "seen", "source": "https://t.me/ctinow/170810", "content": "https://ift.tt/qw9H3nm\nCVE-2023-50893 | UpSolution Impreza Plugin up to 8.17.4 on WordPress cross site scripting", "creation_timestamp": "2024-01-21T11:41:36.000000Z"}, {"uuid": "94baebe7-069f-483b-9a74-a34e1cbf35aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50891", "type": "seen", "source": "https://t.me/ctinow/170811", "content": "https://ift.tt/3zRI5E8\nCVE-2023-50891 | Zoho Forms Plugin up to 3.0.1 on WordPress cross site scripting", "creation_timestamp": "2024-01-21T11:41:38.000000Z"}, {"uuid": "bd88cdd5-6270-4359-a4d0-0bb142858aa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50896", "type": "seen", "source": "https://t.me/ctinow/170805", "content": "https://ift.tt/Q10jZDp\nCVE-2023-50896 | weForms Easy Drag & Drop Contact Form Builder Plugin up to 1.6.17 on WordPress cross site scripting", "creation_timestamp": "2024-01-21T11:11:42.000000Z"}, {"uuid": "d0b5a1fe-5e8a-40af-8b53-1aee705c0ba3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50892", "type": "seen", "source": "https://t.me/ctinow/170804", "content": "https://ift.tt/BPIz8rf\nCVE-2023-50892 | CodexThemes TheGem Theme up to 5.9.1 on WordPress cross site scripting", "creation_timestamp": "2024-01-21T11:11:41.000000Z"}, {"uuid": "c58bd5e1-a4ff-4b92-bb70-3b0735e04c2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50896", "type": "seen", "source": "https://t.me/ctinow/160453", "content": "https://ift.tt/aAo0xe7\nCVE-2023-50896", "creation_timestamp": "2023-12-29T12:26:33.000000Z"}, {"uuid": "c2203861-b7aa-4dd2-b681-d683dc1bfe25", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50893", "type": "seen", "source": "https://t.me/ctinow/160507", "content": "https://ift.tt/ipWn2bB\nCVE-2023-50893", "creation_timestamp": "2023-12-29T13:27:13.000000Z"}, {"uuid": "9ac8800c-f693-487e-bcff-cf7c03287f05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50892", "type": "seen", "source": "https://t.me/ctinow/160506", "content": "https://ift.tt/CLbUPMJ\nCVE-2023-50892", "creation_timestamp": "2023-12-29T13:27:12.000000Z"}, {"uuid": "182289b2-00f2-4722-b8c2-ba1d07625151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-50891", "type": "seen", "source": "https://t.me/ctinow/160505", "content": "https://ift.tt/9CzUNlE\nCVE-2023-50891", "creation_timestamp": "2023-12-29T13:27:11.000000Z"}, {"uuid": "a931fbec-c3d8-4d5d-a36c-638beb4a3689", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-5089", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/191963", "content": "NASA \u2014 Hidden Login Page Bypass via auth\\_redirect + 403 Bypass (CVE-2023\u20135089)\n\nDefender Security versions prior to 4.1.0 fail to properly restrict access to the WordPress login page when the Hide Login Page feature is enabled. By abusing the auth_redirect function (CVE-2023\u20135089), an unauthenticated attacker can trigger a redirect to the login endpoint and bypass the initial HTTP 403 restriction via URL path manipulation, gaining access to the WordPress login page. This issue constitutes a Broken Access Control vulnerability, as unauthenticated users can bypass enforced access restrictions and interact with a fully restricted authentication endpoint, resulting in an implicit privilege escalation and enabling further attacks such as brute force, credential stuffing, and user enumeration.Trigger auth_redirect (CVE-2023\u20135089) The application triggers a redirect to the WordPress login endpoint via auth_redirect. Target:https://partnerships.gsfc.nasa.gov/?gf_page=randomstring The initial HTTP request is performed, which triggers an automatic redirection to a protected resource. The redirection is followed to the authentication endpoint, which is expected to display the login interface; however, due to the configured access restrictions, this resource should not be accessible or visible to unauthenticated users.Step 2 \u2014 Login Page Access Blocked (403) The identified condition is validated by reproducing it directly within a web browser. Redirected URL: https://partnerships.gsfc.nasa.gov/code102/?redirect_to=https%3A%2F%2Fpartnerships.gsfc.nasa.gov%2F%3Fgf_page%3Drandomstring&reauth=1 Result:403 restriction is bypassedWordPress login page becomes accessible By manipulating the URL through GET parameters, it is possible to access and display the WordPress login interface, effectively bypassing the previously configured access restrictions. Next, the same HTTP 403 (Forbidden) bypass technique is tested to validate authentication credentials. The HTTP request is captured in order to apply the required URL manipulation to bypass the 403 (Forbidden) response. Finally, the bypass is successful, as the application processes the credential validation mechanism even when the supplied credentials are not valid. The combination of:auth_redirect abuse (CVE-2023-5089)URL Path Manipulation allows an unauthenticated attacker to fully bypass the hidden login protection.https://medium.com/media/cc90accf29eb31c7a56f93cdffae7b06/href NASA \u2014 Hidden Login Page Bypass via auth_redirect + 403 Bypass (CVE-2023\u20135089) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-01T20:00:04.407073Z"}, {"uuid": "a59e0aec-914f-46d1-9962-3a5adea0e667", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-5089", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/191963", "content": "NASA \u2014 Hidden Login Page Bypass via auth\\_redirect + 403 Bypass (CVE-2023\u20135089)\n\nDefender Security versions prior to 4.1.0 fail to properly restrict access to the WordPress login page when the Hide Login Page feature is enabled. By abusing the auth_redirect function (CVE-2023\u20135089), an unauthenticated attacker can trigger a redirect to the login endpoint and bypass the initial HTTP 403 restriction via URL path manipulation, gaining access to the WordPress login page. This issue constitutes a Broken Access Control vulnerability, as unauthenticated users can bypass enforced access restrictions and interact with a fully restricted authentication endpoint, resulting in an implicit privilege escalation and enabling further attacks such as brute force, credential stuffing, and user enumeration.Trigger auth_redirect (CVE-2023\u20135089) The application triggers a redirect to the WordPress login endpoint via auth_redirect. Target:https://partnerships.gsfc.nasa.gov/?gf_page=randomstring The initial HTTP request is performed, which triggers an automatic redirection to a protected resource. The redirection is followed to the authentication endpoint, which is expected to display the login interface; however, due to the configured access restrictions, this resource should not be accessible or visible to unauthenticated users.Step 2 \u2014 Login Page Access Blocked (403) The identified condition is validated by reproducing it directly within a web browser. Redirected URL: https://partnerships.gsfc.nasa.gov/code102/?redirect_to=https%3A%2F%2Fpartnerships.gsfc.nasa.gov%2F%3Fgf_page%3Drandomstring&reauth=1 Result:403 restriction is bypassedWordPress login page becomes accessible By manipulating the URL through GET parameters, it is possible to access and display the WordPress login interface, effectively bypassing the previously configured access restrictions. Next, the same HTTP 403 (Forbidden) bypass technique is tested to validate authentication credentials. The HTTP request is captured in order to apply the required URL manipulation to bypass the 403 (Forbidden) response. Finally, the bypass is successful, as the application processes the credential validation mechanism even when the supplied credentials are not valid. The combination of:auth_redirect abuse (CVE-2023-5089)URL Path Manipulation allows an unauthenticated attacker to fully bypass the hidden login protection.https://medium.com/media/cc90accf29eb31c7a56f93cdffae7b06/href NASA \u2014 Hidden Login Page Bypass via auth_redirect + 403 Bypass (CVE-2023\u20135089) was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.\nRead more...", "creation_timestamp": "2026-09-02T01:00:26.729071Z"}]}