CVE-2023-3249: Miniorange WEB3 - Crypto Wallet Login & Nft Token Gating

Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days.

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username.

Affected products

• Miniorange WEB3 - Crypto Wallet Login & Nft Token Gating: up to and including 2.6.0

Published 2023-06-30. Last modified 2026-06-17.