Vulnerability · Published Jun 7, 2023 · Assigned by Wordfence
CVE-2020-36710WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure
Medium 5.3
In plain English
A medium-severity incorrect authorization in WPS Hide Login from tabrisrp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tabrisrp | WPS Hide Login | 0 – through 1.5.4.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N