CVE-2024-2473
MEDIUM 5.3EPSS 1.2%
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
- CVSS v3.1
- 5.3 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - EPSS
- 1.23% chance of exploitation in the next 30 days, 67th percentile
- Nuclei
- medium · CWE-200
- Published
- 2024-06-11
- Updated
- 2026-04-08