CVE-2021-24917CWE-863

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

published December 6, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.4th percentile for exploit probability.

CVSS
—
EPSS
72%
Percentile
99.4
In the wild
Unconfirmed
What it is

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.72179 · 99.4th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2021-12-06T15:55Z
EPSS history
Timeline
  • 06 DEC 15:55Z
    WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header
    cvelistv5