Change WP Admin < 1.1.4 - Secret Login Page Disclosure

2023-07-2700:00:00

Muhamad Arsyad

wp admin

secret login page

permalinks

visitor

url redirect

AI Score

6.8

Confidence

Low

EPSS

0.002

Percentile

53.8%

JSON

Description The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.

- Set custom Login URL under "Settings > Permalinks". For example, `login`
- As an unauthenticated visitor, open https://example.com/wp-admin/customize.php in a different browser
- It will redirect to the login page: https://example.com/login/?redirect_to=https%3A%2F%2Fexample.com%2Fwp-admin%2Fcustomize.php&reauth=1