CVE-2023-3604 Change WP Admin < 1.1.4 - Secret Login Page Disclosure

Q: What is CVE-2023-3604?

CVE-2023-3604 is a high-severity vulnerability in Unknown Change WP Admin Login, published on 21 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Q: Is CVE-2023-3604 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3604 exists.

Q: How do I fix CVE-2023-3604?

No fix has been published for CVE-2023-3604 yet. Limit exposure of the affected software until one is available.

High 7.5 Published 21 Aug 2023 Updated 2 Oct 2024

Attackers can discover the hidden login URL, bypassing security measures in the Change WP Admin Login plugin.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-3604?

CVE-2023-3604 is a high-severity vulnerability in Unknown Change WP Admin Login, published on 21 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.

Which versions are affected by CVE-2023-3604?

It affects 1 product.

Products include Wpexperts All in One Login.

How do I fix CVE-2023-3604?

No fix has been published for CVE-2023-3604 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-3604 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3604 exists.

CVE-2022-1589 Change wp-admin Login < 1.1.0 - Unauthenticated Arbitrary Settings Update High 7.5

Sources

Also known as GHSA-cppp-j42j-cvvh.