CVE-2024-6420 Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

2024-07-2306:00:03

WPScan

github.com

cve-2024

wordpress

plugin

hidden login page

AI Score

Confidence

High

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

The Hide My WP Ghost WordPress plugin before 5.2.02 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:wpplugins:hide_my_wp_ghost:*:*:*:*:*:wordpress:*:*"
    ],
    "vendor": "wpplugins",
    "product": "hide_my_wp_ghost",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "5.2.02",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]