CVE-2020-36710 WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure

Q: What is CVE-2020-36710?

CVE-2020-36710 is a medium-severity vulnerability in tabrisrp WPS Hide Login, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2020-36710 being exploited?

There is no known exploitation of CVE-2020-36710 in the wild and no public exploit code.

Q: How do I fix CVE-2020-36710?

No fix has been published for CVE-2020-36710 yet. Limit exposure of the affected software until one is available.

Medium 5.3 Published 7 Jun 2023 Updated 8 Apr 2026

Unauthenticated attackers can discover the hidden login URL in WPS Hide Login, enabling credential brute-force attacks despite plugin settings.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-36710?

CVE-2020-36710 is a medium-severity vulnerability in tabrisrp WPS Hide Login, published on 7 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2.

Weakness: CWE-863

Which versions are affected by CVE-2020-36710?

It affects 1 product.

Products include Wpserveur Wps Hide Login.

How do I fix CVE-2020-36710?

No fix has been published for CVE-2020-36710 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-36710 being exploited?

There is no known exploitation of CVE-2020-36710 in the wild and no public exploit code.

Sources

Also known as GHSA-qhhh-gxxv-pg3h.