CVE-2024-6289

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6289
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/ Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*
History

16 Jul 2024, 18:08

Type Values Removed Values Added
First Time Wpserveur
Wpserveur wps Hide Login
CPE cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*
References () https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/ - () https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/ - Exploit, Third Party Advisory
CWE CWE-601
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

15 Jul 2024, 13:00

Type Values Removed Values Added
Summary
  • (es) El complemento WPS Hide Login WordPress anterior a 1.9.16.4 no impide las redirecciones a la página de inicio de sesión a través de la función auth_redirect de WordPress, lo que permite que un visitante no autenticado acceda a la página de inicio de sesión oculta.

15 Jul 2024, 06:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-15 06:15

Updated : 2024-07-16 18:08

NVD link : CVE-2024-6289

Mitre link : CVE-2024-6289

CVE.ORG link : CVE-2024-6289

JSON object : View

Products Affected

wpserveur

  • wps_hide_login
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')