WordPress Plugin Vulnerabilities

WPS Hide Login < 1.9.12 - Hidden Login Page Location Disclosure

Description

The plugin is vulnerable to login page disclosure in all versions up to, and including, 1.9.11. This makes it possible for unauthenticated attackers to bypass an intended security restriction designed to prevent brute force authentication attempts on multi-site installations.

Affects Plugins

Plugin icon
wps-hide-login
Fixed in 1.9.12

References

CVE
CVE-2023-49748
URL
https://patchstack.com/database/vulnerability/wps-hide-login/wordpress-wps-hide-login-plugin-1-9-11-secret-login-page-location-disclosure-on-multisites-vulnerability

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
3.7 (low)

Miscellaneous

Original Researcher
Naveen Muthusamy
Verified
No
WPVDB ID
c49f1098-86e8-4570-9c44-0ccf0c25217a

Timeline

Publicly Published
2024-01-10 (about 2 years ago)
Added
2024-01-20 (about 2 years ago)
Last Updated
2024-01-20 (about 2 years ago)

Other

Published
Title
Published
2025-08-14
Title
B Slider - Gutenberg Slider Block for WP < 2.0.1 - Authenticated (Subscriber+) Sensitive Information Exposure
Published
2026-05-11
Title
Slek Gateway for WooCommerce <= 1.0 - Unauthenticated Insufficiently Protected Credentials via Payment Redirect Form Hidden Fields
Published
2024-07-09
Title
Gravity Forms: Multiple Form Instances < 1.1.2 - Unauthenticated Full Path Disclosure
Published
2024-05-07
Title
Dynamics 365 Integration < 1.3.18 - Unauthenticated Sensitive Information Exposure
Published
2024-06-04
Title
Open Graph < 1.11.3 - Unauthenticated Sensitive Information Exposure