CVE-2023-3404

Summary

CVE-2023-3404 is a vulnerability affecting the ProfileGrid plugin for WordPress. In versions up to 5.5.0, the 'pm_encrypt_decrypt_pass' function contains hardcoded passphrases and initialization vectors, allowing authenticated attackers with administrator-level permissions or above to decrypt and view users' passwords. This issue poses a significant risk, particularly when combined with other vulnerabilities, potentially granting lower-privileged users unauthorized access to users' sensitive information. WordPress users are advised to update the ProfileGrid plugin to the latest version to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.