WPS Hide Login < 1.9.12 - Hidden Login Page Location Disclosure

2024-01-2000:00:00

wpscan.com

plugin

vulnerability

disclosure

security

restriction

brute force

authentication

multi-site

AI Score

7.4

Confidence

Low

EPSS

Percentile

9.0%

JSON

Description The plugin is vulnerable to login page disclosure in all versions up to, and including, 1.9.11. This makes it possible for unauthenticated attackers to bypass an intended security restriction designed to prevent brute force authentication attempts on multi-site installations.

References

patchstack.com/database/vulnerability/wps-hide-login/wordpress-wps-hide-login-plugin-1-9-11-secret-login-page-location-disclosure-on-multisites-vulnerability