CVE-2021-24917 WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

2021-12-0615:55:30

CWE-863

WPScan

www.cve.org

0.041 Low

EPSS

Percentile

92.2%

JSON

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

CNA Affected

[
  {
    "product": "WPS Hide Login",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.9.1",
        "status": "affected",
        "version": "1.9.1",
        "versionType": "custom"
      }
    ]
  }
]