CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPServeur, NicolasKulka, wpformation WPS Hide Login allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPS Hide Login: from n/a through 1.9.11.
Explanation of Vulnerability in Simple Terms
WPS Hide Login versions up to 1.9.11 expose sensitive information through improper access controls. An attacker can discover the hidden WordPress login URL without authentication, though significant effort is required due to high attack complexity. This allows reconnaissance of the site's login mechanism but does not grant access to accounts or data.
What an attacker can do
Discover the hidden WordPress login URL through network reconnaissance.
Potential impact on your site
Attackers can identify your hidden login page, reducing the security benefit of the plugin's URL obfuscation.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but attack requires significant effort.
Key dates
External resources
Related vulnerabilities
