WordPress Plugin Vulnerabilities

Change WP Admin < 1.1.4 - Secret Login Page Disclosure

Description

The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered.

Proof of Concept

Affects Plugins

Plugin icon
change-wp-admin-login
Fixed in 1.1.4

References

CVE
CVE-2023-3604

Miscellaneous

Original Researcher
Muhamad Arsyad
Submitter
Muhamad Arsyad
Verified
Yes
WPVDB ID
8f6615e8-f607-4ce4-a0e0-d5fc841ead16

Timeline

Publicly Published
2023-07-27 (about 2 years ago)
Added
2023-07-27 (about 2 years ago)
Last Updated
2023-07-27 (about 2 years ago)

Other

Published
Title
Published
2020-03-04
Title
WooCommerce Smart Coupons < 4.6.5 - Unauthenticated Coupon Creation
Published
2022-12-27
Title
WP Limit Login Attempts <= 2.6.5 - IP Spoofing
Published
2023-10-03
Title
Captcha/Honeypot for Contact Form 7 < 1.11.4 - Captcha Bypass
Published
2016-09-26
Title
W3 Total Cache < 0.9.5 – Unauthenticated Security Token Bypass
Published
2014-12-02
Title
InfiniteWP Client <= 1.3.7 - Privilege Escalation