Description
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| tabrisrp | WPS Hide Login | ≤ 1.9.15.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- WPS Hide Login <= 1.9.15.2 - Login Page Disclosure http/cves/2024/CVE-2024-2473.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.