WPS Hide Login < 1.9.12 - Hidden Login Page Location Disclosure

2024-01-2000:00:00

wpscan.com

plugin

vulnerability

disclosure

security

restriction

brute force

authentication

multi-site

7.4 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Description The plugin is vulnerable to login page disclosure in all versions up to, and including, 1.9.11. This makes it possible for unauthenticated attackers to bypass an intended security restriction designed to prevent brute force authentication attempts on multi-site installations.

CPENameOperatorVersion
eq1.9.12

CPE	Name	Operator	Version
		eq	1.9.12

References

patchstack.com/database/vulnerability/wps-hide-login/wordpress-wps-hide-login-plugin-1-9-11-secret-login-page-location-disclosure-on-multisites-vulnerability