CVSS: 7.5EPSS: 2%CPEs: 1EXPL: 3CVE-2021-24917 – WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
https://notcve.org/view.php?id=CVE-2021-24917
The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. El plugin WPS Hide Login de WordPress versiones anteriores a 1.9.1, presenta un bug que permite conseguir la página secreta de inicio de sesión estableciendo una cadena de referencia aleatoria y haciendo una petición a /wp-admin/options.php como un usuario no autenticado • https://github.com/dikalasenjadatang/CVE-2021-24917 https://github.com/Cappricio-Securities/CVE-2021-24917 https://wordpress.org/support/topic/bypass-security-issue https://wpscan.com/vulnerability/15bb711a-7d70-4891-b7a2-c473e3e8b375 • CWE-863: Incorrect Authorization •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 1CVE-2021-3332
https://notcve.org/view.php?id=CVE-2021-3332
WPS Hide Login 1.6.1 allows remote attackers to bypass a protection mechanism via post_password. WPS Hide Login versión 1.6.1, permite a atacantes remotos omitir un mecanismo de protección por medio de post_password • https://blog.sebastianschmitt.eu/security/wps-hide-login-1-6-1-protection-bypass-cve-2021-3332 • CWE-287: Improper Authentication •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-36710 – WPS Hide Login <= 1.5.4.2 - Hidden Login Page Location Disclosure
https://notcve.org/view.php?id=CVE-2020-36710
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the plugin are set to hide the login page making it possible for unauthenticated attackers to brute force credentials on sites in versions up to, and including, 1.5.4.2. • https://blog.nintechnet.com/wordpress-wps-hide-login-fixed-security-issue https://www.wordfence.com/threat-intel/vulnerabilities/id/7808329f-1688-480c-a83c-c4ab2fa86da6?source=cve • CWE-863: Incorrect Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15823 – WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=confirmaction'
https://notcve.org/view.php?id=CVE-2019-15823
The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass. El plugin wps-hide-login anterior a la versión 1.5.3 para WordPress tiene un bypass de protección acción = confirmación. The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure in versions up to, and including, 1.5.2.2. This is due to a bypass that is created when the 'action=confirmaction' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin. • https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities https://wordpress.org/plugins/wps-hide-login/#developers https://wpvulndb.com/vulnerabilities/9469 • CWE-285: Improper Authorization •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15825 – WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'action=rp'
https://notcve.org/view.php?id=CVE-2019-15825
The wps-hide-login plugin before 1.5.3 for WordPress has an action=rp&key&login protection bypass. El complemento wps-hide-login antes de 1.5.3 para WordPress tiene una acción = rp & key & bypass de protección de inicio de sesión. The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure in versions up to, and including, 1.5.2.2. This is due to a bypass that is created when the 'action=rp&key&login' parameters are supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin. • https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities https://wordpress.org/plugins/wps-hide-login/#developers https://wpvulndb.com/vulnerabilities/9469 • CWE-693: Protection Mechanism Failure •