CVE-2024-6289 describes a vulnerability in the WPS Hide Login WordPress plugin prior to version 1.9.16.4, which fails to prevent redirects to the hidden login page via the auth_redirect function. This allows unauthenticated users to discover the login page, undermining the plugin's intended security through obscurity. Rated as MEDIUM severity with a CVSS score of 6.1, the vulnerability has a low attack complexity and requires user interaction (UI:R), but can be exploited remotely (AV:N). Successful exploitation could lead to limited disclosure of information (C:L) and limited integrity impact (I:L), as the hidden login page becomes accessible. Currently, there is no evidence of active exploitation, and it is not listed in the CISA KEV catalog. While Nuclei templates exist for detection, there are no public Metasploit modules or ExploitDB entries. Community discussion and media coverage for this CVE are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.9.16.4CPE matchmatch criteria | cpe:2.3:a:wpserveur:wps_hide_login:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.