Vulnerability · Published Jul 15, 2024 · Assigned by WPScan

CVE-2024-6289WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure

Medium 6.1

In plain English

A medium-severity security flaw in WPS Hide Login from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)0.9%top 40.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

Affected products (as reported)

Vendor	Product	Versions
Unknown	WPS Hide Login	0 – before 1.9.16.4

References

https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/ exploit, vdb-entry, technical-description