Login Sign Up

CVE-2024-2473

5.3 MEDIUM
Authentication Bypass

📋 TL;DR

The WPS Hide Login WordPress plugin has a vulnerability that allows attackers to discover hidden login pages by using the 'action=postpass' parameter. This bypasses the plugin's security feature designed to obscure the WordPress login URL. All WordPress sites using this plugin up to version 1.9.15.2 are affected.

💻 Affected Systems

Products:
  • WPS Hide Login WordPress plugin
Versions: All versions up to and including 1.9.15.2
Operating Systems: Any OS running WordPress
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects WordPress installations with the WPS Hide Login plugin enabled.

📦 What is this software?

Wps Hide Login by Wpserveur

View all CVEs affecting Wps Hide Login →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers discover the hidden login page and launch brute-force attacks or credential stuffing against it, potentially gaining administrative access to the WordPress site.

🟠

Likely Case

Attackers discover the login page and attempt unauthorized access through automated attacks, increasing the risk of successful compromise.

🟢

If Mitigated

With strong passwords, rate limiting, and other security controls, the risk is reduced but the login page remains discoverable.

🌐 Internet-Facing: HIGH
🏢 Internal Only: LOW

🎯 Exploit Status

Public PoC: ⚠️ Yes
Weaponized: LIKELY
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires only adding '?action=postpass' to the hidden login URL, making it trivial for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.9.15.3 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-login

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find WPS Hide Login. 4. Click 'Update Now' if available, or manually update to version 1.9.15.3+. 5. Verify the plugin is active and functioning.

🔧 Temporary Workarounds

Disable WPS Hide Login Plugin

all

Temporarily disable the vulnerable plugin until patched, reverting to default WordPress login URL.

wp plugin deactivate wps-hide-login

Implement Web Application Firewall (WAF)

all

Configure WAF rules to block requests containing 'action=postpass' parameter to the login page.

🧯 If You Can't Patch

  • Implement strong password policies and multi-factor authentication for all admin accounts
  • Enable rate limiting and IP blocking for failed login attempts

🔍 How to Verify

Check if Vulnerable:

Check if WPS Hide Login plugin is installed and version is 1.9.15.2 or lower in WordPress admin panel or via wp-cli.

Check Version:

wp plugin get wps-hide-login --field=version

Verify Fix Applied:

After updating, test if adding '?action=postpass' to the hidden login URL still reveals the login page (it should not).

📡 Detection & Monitoring

Log Indicators:

  • HTTP requests to login URLs containing 'action=postpass' parameter
  • Increased failed login attempts from new IPs

Network Indicators:

  • Unusual traffic patterns to hidden login endpoints
  • Scans for WordPress login pages

SIEM Query:

source="web_logs" AND (url="*action=postpass*" OR url="*/wp-login.php*")

📊 Metadata

CVE ID: CVE-2024-2473
CVSS v3 Score: 5.3 (MEDIUM)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: June 11, 2024
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON