CVE-2024-37881 Information disclosure in SiteGuard WP Plugin
An attacker can discover the customized login URL by accessing the registration page, exposing the hidden login path.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37881?
CVE-2024-37881 is a medium-severity vulnerability in SiteGuard WP Plugin, published on 19 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SiteGuard WP Plugin provides a functionality to customize the path to the login page wp-login.php and implements a measure to avoid redirection from other URLs. However, SiteGuard WP Plugin versions prior to 1.7.7 missed to implement a measure to avoid redirection from wp-register.php. As a result, the customized path to the login page may be exposed.
Which versions are affected by CVE-2024-37881?
How do I fix CVE-2024-37881?
No fix has been published for CVE-2024-37881 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-37881 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37881 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-jcmc-rcp5-r722.