WordPress Plugin Vulnerabilities

Hide My WP < 6.2.4 - Unauthenticated Reset Token Disclosure

Description

The plugin does not have proper authorisation in the die_message() function, hooked to admin_init, allowing unauthenticated user to call and retrieve the reset token which could then be used to deactivate the plugin.

Proof of Concept

Affects Plugins

Plugin icon
hide_my_wp
Fixed in 6.2.4

References

CVE
CVE-2021-36917

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Dave Jong
Verified
No
WPVDB ID
e911b383-7437-429d-a12b-40fafacc3042

Timeline

Publicly Published
2021-11-24 (about 4 years ago)
Added
2022-11-30 (about 3 years ago)
Last Updated
2022-11-30 (about 3 years ago)

Other

Published
Title
Published
2025-04-09
Title
Squeeze < 1.6.1 - Authenticated (Admin+) Full Path Disclosure
Published
2026-01-26
Title
Nexter Blocks < 4.6.4 - Authenticated (Subscriber+) Information Exposure
Published
2024-11-26
Title
ProfilePress < 4.15.19 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Published
2025-04-07
Title
Accept SagePay Payments Using Contact Form 7 < 2.1 - Unauthenticated Information Exposure
Published
2025-10-10
Title
Trinity Audio < 5.22.0 - Unauthenticated Information Exposure