What’s Vulnerable › Vulnerabilities

CVE-2024-2473: WPS Hide Login <= 1.9.15.2 - Login Page Disclosure

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-11 · updated 2026-06-17
• Weakness: CWE-863

Description

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

Affected products

• tabrisrp WPS Hide Login: before 1.9.16 — fixed in 1.9.16

How to fix

Upgrade to a fixed version: tabrisrp WPS Hide Login 1.9.16. Check the vendor advisory for mitigations.

References

• https://github.com/whattheslime/wps-show-login
• https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve
• https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve

Get alerted when CVE-2024-2473 or the next vulnerability affects your stack