CVE-2023-6036 is a critical (CVSS 9.8 in the record) authentication bypass in the Web3 plugin for WordPress, before 3.0.0. An unauthenticated attacker who knows a username can log in as that user, including an administrator. Update to 3.0.0 or later at once. WPScan scores it 8.8 High.
What's affected
- Plugin: Web3, listed as Web3 Crypto Wallet Login and NFT Token Gating, by miniOrange.
- Affected: versions before 3.0.0.
- Fixed: 3.0.0, per WPScan.
- Severity: 9.8 Critical in the NVD record. WPScan scores it 8.8 High. Both are in the range that calls for immediate action.
- Condition: the attacker needs a valid username, which is often easy to find on a WordPress site.
How to check if you're exposed
In the WordPress admin, open Plugins and read the version shown under Web3. With shell access and WP-CLI, this lists every installed plugin with its version, status and whether an update is waiting:
wp plugin list --fields=name,title,version,status,update
Find the row for Web3 and compare its version with the fixed version above. On a multisite network, run the same command on each site, because a plugin can be active on some sites and not others. Look for the entry titled Web3 or Web3 Crypto Wallet Login.
A version below 3.0.0 is affected. If the plugin has been active, review the WordPress user list and login records for administrator logins you cannot account for.
What to do now
- Update the plugin to 3.0.0 or later. If you do not use wallet login, deactivate and delete it.
- Review administrator and editor accounts for new users or changed email addresses.
- Check login history, if you keep one, for administrator logins at unusual times or from unfamiliar addresses.
- Reset passwords and end all sessions for privileged accounts if you see anything unexplained.
- Check installed plugins, themes and scheduled tasks for additions you did not make.
Why it matters
The login flow in two plugin functions checks the identity of the caller incorrectly. The record classes it as CWE-863, incorrect authorization. A request that should prove the user controls a crypto wallet can instead be accepted for an existing account name. With only a username, an outsider can sign in as that person.
Authentication bypass in a login plugin is about as bad as plugin bugs get. It takes no password, no special account and no user interaction, and it lands on whichever user the attacker names, usually the administrator. From there an attacker can install plugins and change the site. The record does not list this CVE as known exploited, and none of the fetched pages say it is. WPScan's page includes a script that proves the issue, so assume attackers can reproduce it.
Quick check
I never use wallet login. Am I safe?
Only if the plugin is deactivated or removed. An installed and active plugin keeps its login handler available even if nobody uses it.
Sources
Last reviewed: 19 October 2026.
