CVE-2024-2473

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-2473
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*
History

25 Jul 2024, 13:25

Type Values Removed Values Added
First Time Wpserveur
Wpserveur wps Hide Login
CPE cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*
CWE NVD-CWE-noinfo
References () https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login - () https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login - Patch
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cve - Third Party Advisory

11 Jun 2024, 13:54

Type Values Removed Values Added
Summary
  • (es) El complemento WPS Hide Login para WordPress es vulnerable a la divulgación de la página de inicio de sesión en todas las versiones hasta la 1.9.15.2 incluida. Esto se debe a una omisión que se crea cuando se proporciona el parámetro 'action=postpass'. Esto hace posible que los atacantes descubran fácilmente cualquier página de inicio de sesión que pueda haber sido ocultada por el complemento.

11 Jun 2024, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-11 03:15

Updated : 2024-07-25 13:25

NVD link : CVE-2024-2473

Mitre link : CVE-2024-2473

CVE.ORG link : CVE-2024-2473

JSON object : View

Products Affected

wpserveur

  • wps_hide_login
CWE
NVD-CWE-noinfo