CVE-2024-6289: WPS Hide Login < 1.9.16.4 - Hidden Login Page Disclosure
The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the authredirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6289?
CVE-2024-6289 has a medium severity rating due to its potential for unauthorized access to the hidden login page.
How do I fix CVE-2024-6289?
To fix CVE-2024-6289, update the WPS Hide Login plugin to version 1.9.16.4 or later.
Who is affected by CVE-2024-6289?
Users of the WPS Hide Login WordPress plugin versions prior to 1.9.16.4 are affected by CVE-2024-6289.
What is the impact of CVE-2024-6289?
The impact of CVE-2024-6289 allows unauthenticated visitors to access the hidden login page, potentially increasing the risk of brute-force attacks.
Are there any workarounds for CVE-2024-6289?
Currently, the best workaround for CVE-2024-6289 is to disable the WPS Hide Login plugin until it can be updated.