CVE-2024-6289 - OpenCVE

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Wpserveur	Wps Hide Login

Configuration 1 [-]

cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:*

No data.

References

Link	Providers
https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/

History

No history.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2024-07-15T06:00:06.081Z

Updated: 2024-08-01T21:33:05.447Z

Reserved: 2024-06-24T18:02:54.875Z

Link: CVE-2024-6289

Vulnrichment

Updated: 2024-08-01T21:33:05.447Z

NVD

Status : Analyzed

Published: 2024-07-15T06:15:02.413

Modified: 2024-07-16T18:08:12.880

Link: CVE-2024-6289

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-6289", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2024-06-24T18:02:54.875Z", "datePublished": "2024-07-15T06:00:06.081Z", "dateUpdated": "2024-08-01T21:33:05.447Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-07-15T06:00:06.081Z"}, "title": "WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure", "problemTypes": [{"descriptions": [{"description": "CWE-200 Information Exposure", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "WPS Hide Login", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.9.16.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page."}], "references": [{"url": "https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Juan Pablo Gomez Postigo", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"affected": [{"vendor": "wpserveur", "product": "wps_hide_login", "cpes": ["cpe:2.3:a:wpserveur:wps_hide_login:-:*:*:*:*:wordpress:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "1.9.16.4", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-24T19:11:36.635786Z", "id": "CVE-2024-6289", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T19:12:38.336Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:33:05.447Z"}, "title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/", "tags": ["exploit", "vdb-entry", "technical-description", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:33:05.447Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-6289", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-24T19:11:36.635786Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wpserveur:wps_hide_login:-:*:*:*:*:wordpress:*:*"], "vendor": "wpserveur", "product": "wps_hide_login", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.16.4", "versionType": "semver"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-24T19:12:32.088Z"}}], "cna": {"title": "WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Juan Pablo Gomez Postigo"}, {"lang": "en", "type": "coordinator", "value": "WPScan"}], "affected": [{"vendor": "Unknown", "product": "WPS Hide Login", "versions": [{"status": "affected", "version": "0", "lessThan": "1.9.16.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://wpscan.com/vulnerability/fd6d0362-df1d-4416-b8b5-6e5d0ce84793/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "x_generator": {"engine": "WPScan CVE Generator"}, "descriptions": [{"lang": "en", "value": "The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-200 Information Exposure"}]}], "providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2024-07-15T06:00:06.081Z"}}}, "cveMetadata": {"cveId": "CVE-2024-6289", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:33:05.447Z", "dateReserved": "2024-06-24T18:02:54.875Z", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "datePublished": "2024-07-15T06:00:06.081Z", "assignerShortName": "WPScan"}, "dataVersion": "5.1"}