CVE-2023-3604
📋 TL;DR
The Change WP Admin Login WordPress plugin before version 1.1.4 exposes the hidden login page URL when a specially crafted URL is accessed, allowing attackers to bypass the plugin's intended protection. This affects WordPress sites using vulnerable versions of the plugin.
💻 Affected Systems
- Change WP Admin Login WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers discover the hidden admin login URL and gain unauthorized access to WordPress admin panel, potentially leading to site takeover, data theft, or malware injection.
Likely Case
Attackers find the hidden login page and attempt brute-force attacks or credential stuffing against the exposed login interface.
If Mitigated
Even with the URL exposed, strong authentication controls prevent unauthorized access.
🎯 Exploit Status
Exploitation requires accessing a crafted URL that triggers the information disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.4
Vendor Advisory: https://wpscan.com/vulnerability/8f6615e8-f607-4ce4-a0e0-d5fc841ead16
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Change WP Admin Login' plugin. 4. Click 'Update Now' if update available. 5. Alternatively, download version 1.1.4+ from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the Change WP Admin Login plugin until patched.
wp plugin deactivate change-wp-admin-login
Implement web application firewall rule
allBlock access to crafted URLs that trigger the vulnerability.
🧯 If You Can't Patch
- Implement strong authentication controls (2FA, strong passwords) on WordPress admin accounts
- Monitor access logs for unusual login attempts to hidden admin URLs
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for 'Change WP Admin Login' version number.Check Version:
wp plugin list --name=change-wp-admin-login --field=versionVerify Fix Applied:
Verify plugin version is 1.1.4 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to crafted URLs containing specific parameters
- Multiple failed login attempts to previously hidden admin URLs
Network Indicators:
- HTTP requests to WordPress site with crafted parameters targeting the plugin
SIEM Query:
web.url:*change-wp-admin-login* OR web.url:*admin* AND web.status:200 AND NOT user_agent:normal_bot