CVE-2019-15826
WPS Hide Login <= 1.5.2.2 - Login Page Disclosure via Referer Header
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
El plugin wps-hide-login anterior a la versión 1.5.3 para WordPress tiene un bypass de protección a través de wp-login.php en el campo Referer.
The wps-hide-login plugin before 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure in versions up to, and including, 1.5.2.2. This is due to a bypass that is created when wp-login.php?action=postpass is supplied via the 'Referer' header. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
*Credits:
Julio Potier
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2019-07-23 CVE Published
- 2019-08-29 CVE Reserved
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- 2024-08-23 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-693: Protection Mechanism Failure
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
https://wordpress.org/plugins/wps-hide-login/#developers | Product | |
https://wpvulndb.com/vulnerabilities/9469 | Third Party Advisory |
URL | Date | SRC |
---|---|---|
https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities | 2024-08-05 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Wpserveur Search vendor "Wpserveur" | Wps Hide Login Search vendor "Wpserveur" for product "Wps Hide Login" | < 1.5.3 Search vendor "Wpserveur" for product "Wps Hide Login" and version " < 1.5.3" | wordpress |
Affected
|