Vulnerability · Published Jun 11, 2024 · Assigned by Wordfence
CVE-2024-2473WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
Medium 5.3
In plain English
A medium-severity incorrect authorization in WPS Hide Login from tabrisrp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tabrisrp | WPS Hide Login | 0 – through 1.9.15.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N