CVE-2019-15824
WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via 'adminhash'
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The wps-hide-login plugin before 1.5.3 for WordPress has an adminhash protection bypass.
El plugin wps-hide-login anterior a la versión 1.5.3 para WordPress tiene un bypass de protección adminhash.
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure in versions up to, and including, 1.5.2.2. This is due to a bypass that is created when the 'adminhash' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-07-22 CVE Published
- 2019-08-29 CVE Reserved
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2024-08-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-693: Protection Mechanism Failure
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://wordpress.org/plugins/wps-hide-login/#developers | Product | |
https://wpvulndb.com/vulnerabilities/9469 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wpserveur Search vendor "Wpserveur" | Wps Hide Login Search vendor "Wpserveur" for product "Wps Hide Login" | < 1.5.3 Search vendor "Wpserveur" for product "Wps Hide Login" and version " < 1.5.3" | wordpress |
Affected
|