Lucene search

WordfenceCVE-2024-2473

HistoryJun 11, 2024 - 3:15 a.m.

CVE-2024-2473

2024-06-1103:15:10

Wordfence

web.nvd.nist.gov

cve-2024-2473

wordpress

wps hide login

vulnerable plugin

security bypass

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the ‘action=postpass’ parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

Affected configurations

Nvd

Vulners

Node

wpserveurwps_hide_loginRange<1.9.16wordpress

VendorProductVersionCPE
wpserveurwps_hide_login*cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
wpserveur	wps_hide_login	*	cpe:2.3:a:wpserveur:wps_hide_login::::::wordpress::*

CNA Affected

[
  {
    "vendor": "tabrisrp",
    "product": "WPS Hide Login",
    "versions": [
      {
        "version": "*",
        "status": "affected",
        "lessThanOrEqual": "1.9.15.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

plugins.trac.wordpress.org/changeset/3099109/wps-hide-login

www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

5.3

Confidence

High

EPSS

0.001

Percentile

17.0%

JSON

Related for CVE-2024-2473