CVE-2024-2473 WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
Attackers can bypass login page hiding features to discover hidden WordPress login URLs, exposing the site to brute-force attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-2473?
CVE-2024-2473 is a medium-severity vulnerability in tabrisrp WPS Hide Login, published on 11 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
Weakness: CWE-863
Which versions are affected by CVE-2024-2473?
It affects 1 product.
Products include Wpserveur Wps Hide Login.
How do I fix CVE-2024-2473?
No fix has been published for CVE-2024-2473 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-2473 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-2473 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in tabrisrp WPS Hide Login
Sources
Also known as GHSA-cwvf-77f4-2gc5.