WPS Hide Login

WPS Hide Login before 1.5.3 can be tricked into revealing the secret login URL it is meant to hide (CVE-2019-15823, CVE-2019-15824, CVE-2019-15825, CVE-2019-15826). Unauthenticated visitors can obtain it with crafted requests using action=confirmaction, the adminhash parameter, action=rp with key and login (when WooCommerce is active), or a wp-login.php Referer header. This exposes the login page to brute-force and credential-stuffing attacks.

This vulnerability affects the following application versions:

• WPS Hide Login 1.5
• WPS Hide Login 1.5.1
• WPS Hide Login 1.5.2
• WPS Hide Login 1.5.2.1
• WPS Hide Login 1.5.2.2

The plugin is vulnerable to login page disclosure which makes it possible for unauthenticated attackers to bypass an intended security restriction designed to prevent brute force authentication attempts on multi-site installations.

This vulnerability affects the following application versions:

• WPS Hide Login 1.5
• WPS Hide Login 1.5.1
• WPS Hide Login 1.5.2
• WPS Hide Login 1.5.2.1
• WPS Hide Login 1.5.2.2
• WPS Hide Login 1.5.3
• WPS Hide Login 1.5.4
• WPS Hide Login 1.5.4.1
• WPS Hide Login 1.5.4.2
• WPS Hide Login 1.5.5
• WPS Hide Login 1.5.6
• WPS Hide Login 1.5.7
• WPS Hide Login 1.6
• WPS Hide Login 1.6.1
• WPS Hide Login 1.7
• WPS Hide Login 1.8
• WPS Hide Login 1.8.1
• WPS Hide Login 1.8.2
• WPS Hide Login 1.8.3
• WPS Hide Login 1.8.4
• WPS Hide Login 1.8.5
• WPS Hide Login 1.8.6
• WPS Hide Login 1.8.7
• WPS Hide Login 1.8.8
• WPS Hide Login 1.9
• WPS Hide Login 1.9.1
• WPS Hide Login 1.9.2
• WPS Hide Login 1.9.3
• WPS Hide Login 1.9.4
• WPS Hide Login 1.9.5
• WPS Hide Login 1.9.6
• WPS Hide Login 1.9.7
• WPS Hide Login 1.9.8
• WPS Hide Login 1.9.9
• WPS Hide Login 1.9.10
• WPS Hide Login 1.9.11