The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
References
Link | Resource |
---|---|
https://wordpress.org/support/topic/bypass-security-issue/ | Third Party Advisory |
https://wpscan.com/vulnerability/15bb711a-7d70-4891-b7a2-c473e3e8b375 | Exploit Third Party Advisory |
https://wordpress.org/support/topic/bypass-security-issue/ | Third Party Advisory |
https://wpscan.com/vulnerability/15bb711a-7d70-4891-b7a2-c473e3e8b375 | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 05:54
Type | Values Removed | Values Added |
---|---|---|
References | () https://wordpress.org/support/topic/bypass-security-issue/ - Third Party Advisory | |
References | () https://wpscan.com/vulnerability/15bb711a-7d70-4891-b7a2-c473e3e8b375 - Exploit, Third Party Advisory |
Information
Published : 2021-12-06 16:15
Updated : 2024-11-21 05:54
NVD link : CVE-2021-24917
Mitre link : CVE-2021-24917
CVE.ORG link : CVE-2021-24917
JSON object : View
Products Affected
wpserveur
- wps_hide_login
CWE
CWE-863
Incorrect Authorization