CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the logi...

CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the logi...

CVE-2026-110691

The WPOrLogin WordPress plugin (versions before 3.1.0 ) is vulnerable to an unauthenticated hide login slug update vulnerability. The root cause is a failure to perform a capability check or nonce validation when updating the plugin's hidden-login URL settings. An unauthenticated attacker could e...

WordPress All-in-One Security <=4.4.1 - Hidden Login Page Exposure Detection

WordPress All-in-One Security plugin through 4.4.1 contains an exposure of the actual URL of the "hidden login page" feature. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress All-in-One Security plugin through 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WordPress All-in-One Security <=4.4.1 - Open Redirect Detection

WordPress All-in-One Security plugin through 4.4.1 contains an open redirect vulnerability which can expose the actual URL of the hidden login page feature. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

Defender Security < 4.1.0 - Protection Bypass (Hidden Login Page) Detection

The Defender Security WordPress plugin before 4.1.0 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the login page, even when the hide login page functionality of the plugin is enabled. !/usr/bin/env python3 --...

CVE-2024-6420

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2023-3604

The Change WP Admin Login WordPress plugin before 1.1.4 discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered...

CVE-2024-13794

The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to...

PT-2025-6451 · WordPress · Wp Ghost

Name of the Vulnerable Software and Affected Versions: The WP Ghost Hide My WP Ghost – Security & Firewall plugin for WordPress versions up to, and including, 5.3.02 Description: The issue is due to the plugin not properly restricting the "/wp-register.php" path, making it possible for...

WordPress Hide My WP Ghost plugin < 5.2.02 - Hidden Login Page Disclosure vulnerability

Hidden Login Page Disclosure vulnerability discovered by Juan Pablo Gomez Postigo in WordPress Plugin Hide My WP Ghost versions 5.2.02...

CVE-2024-6420

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2024-6420

The Hide My WP Ghost WordPress plugin, in versions prior to 5.2.02 , contains a bypass vulnerability where it fails to prevent redirects to the login page via the auth_redirect WordPress function. This allows an unauthenticated visitor to discover and access the hidden login page, effectively byp...

CVE-2024-6420 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2024-6420: Undefined Security Weakness

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

PT-2024-37613 · WordPress · Hide My Wp Ghost

Name of the Vulnerable Software and Affected Versions: Hide My WP Ghost WordPress plugin versions prior to 5.2.02 Description: The issue allows an unauthenticated visitor to access the hidden login page due to the plugin not preventing redirects to the login page via the auth redirect WordPress...

WordPress WPS Hide Login plugin < 1.9.16.4 - Hidden Login Page Disclosure vulnerability

Hidden Login Page Disclosure vulnerability discovered by Juan Pablo Gomez Postigo in WordPress Plugin WPS Hide Login versions 1.9.16.4...

CVE-2024-6289

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2024-6289 WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page...

CVE-2024-6289

The CVE-2024-6289 entry concerns the WordPress plugin WPS Hide Login (versions prior to 1.9.16.4). The root cause is improper handling of redirects via the auth_redirect function, allowing an unauthenticated visitor to access the hidden login page. Affected component: the plugin’s login/page redi...