CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Login Page Dislcosure in all versions up to, and including, 5.3.02. This is due to the plugin not properly restricting the /wp-register.php path. This makes it possible for unauthenticated attackers to discover the hidden login page location.
Explanation of Vulnerability in Simple Terms
Hide My WP Ghost versions up to 5.3.02 expose sensitive information through improper access controls. An unauthenticated attacker can read non-public data by sending network requests to the affected plugin. The vulnerability requires no user interaction and affects the confidentiality of site information. Update to a version newer than 5.3.02 to resolve this issue.
What an attacker can do
Read sensitive site information without authentication.
Potential impact on your site
Attackers can discover non-public information about your site configuration or data.
Conditions required to exploit
Network access to the WordPress site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
