Read the docs
TI-2024-02299 Aliases CVE-2024-2473GHSA-cwvf-77f4-2gc5

WPS Hide Login <= 1.9.15.2 - Login Page Disclosure

Priority LOW 27CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-863.

Summary

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01235 69th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
tabrisrpWPS Hide Loginup to 1.9.15.2—No fix listedCNA
  • WPS Hide Login Vendortabrisrp Affected up to 1.9.15.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*before 1.9.16VulnerableWpserveur
  • cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:* Versions before 1.9.16 Vulnerable ·Wpserveur

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-2473
  2. 2026-10-03 Alias added: GHSA-cwvf-77f4-2gc5

References

Patch 1

Advisory 1

Other 1

  • TI-2021-07197 WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header CVSS 3.1HIGH 7.5
  • TI-2024-05836 WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure CVSS 3.1MEDIUM 6.1
  • TI-2019-11890 The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. CVSS 3.0CRITICAL 9.8
  • TI-2019-11893 The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field. CVSS 3.0CRITICAL 9.8
  • TI-2019-11892 The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. CVSS 3.0CRITICAL 9.8
  • TI-2019-11891 The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass. CVSS 3.0CRITICAL 9.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences