CVE-2021-24917

High

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and…

WPScan·CWE-863·Published 2021-12-06

CVSS

7.5

EPSS

0.72

KEV

Exploits

cve.orgen

209 chars

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

NVDen

209 chars

NVDes

271 chars

El plugin WPS Hide Login de WordPress versiones anteriores a 1.9.1, presenta un bug que permite conseguir la página secreta de inicio de sesión estableciendo una cadena de referencia aleatoria y haciendo una petición a /wp-admin/options.php como un usuario no autenticado

CVSS metrics across sources

Version	Type	Source	Base	Exp	Impact	Vector
2.0	Primary	NVD	5.0	10.0	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N
3.1	Primary	NVD	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N