CVE-2021-24917: WPS Hide Login Auth Bypass Vulnerability

CVE-2021-24917 Overview

CVE-2021-24917 is an authorization bypass vulnerability in the WPS Hide Login WordPress plugin before version 1.9.1. This security flaw allows unauthenticated attackers to discover the secret login page URL that site administrators configure to hide the default WordPress login page. By setting a random referer string and making a request to /wp-admin/options.php, an attacker can bypass the plugin's security mechanism and reveal the hidden login URL.

Critical Impact

Attackers can completely bypass the security-through-obscurity protection offered by WPS Hide Login, exposing the secret admin login page to brute force attacks, credential stuffing, and other authentication-based attacks.

Affected Products

• WPS Hide Login WordPress plugin versions prior to 1.9.1
• WordPress sites using vulnerable versions of wpserveur wps_hide_login
• Any WordPress installation relying on WPS Hide Login for admin URL obfuscation

Discovery Timeline

• 2021-12-06 - CVE-2021-24917 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-24917

Vulnerability Analysis

The WPS Hide Login plugin is designed to protect WordPress installations by allowing administrators to change the default login URL (/wp-login.php) to a custom, secret URL. This vulnerability completely undermines this protection mechanism through improper authorization (CWE-863).

The flaw exists in how the plugin handles requests to /wp-admin/options.php. When an unauthenticated user makes a request to this endpoint with a manipulated HTTP referer header, the plugin fails to properly validate the request context. Instead of blocking or redirecting the request appropriately, the application inadvertently exposes information about the configured secret login page.

This is a network-accessible vulnerability that requires no authentication and no user interaction to exploit. The impact is primarily confidentiality-focused, as successful exploitation reveals sensitive configuration information (the hidden login URL) without directly compromising integrity or availability.

Root Cause

The root cause is improper authorization checking (CWE-863) in the plugin's request handling logic. The plugin fails to adequately validate that requests to sensitive endpoints like /wp-admin/options.php come from authorized sources. By manipulating the HTTP referer header with a random string value, attackers can trigger a code path that reveals the secret login URL that was intended to be hidden.

Attack Vector

The attack is executed remotely over the network by any unauthenticated user. The attacker crafts an HTTP request to the target WordPress site's /wp-admin/options.php endpoint with a manipulated referer header containing a random string value.

The attack flow involves:

1. Attacker identifies a WordPress site using the WPS Hide Login plugin
2. Attacker sends an HTTP request to /wp-admin/options.php with a random referer header
3. The plugin's flawed logic processes the request improperly
4. The response reveals the secret login page URL
5. Attacker can now target the exposed login page for further attacks

For detailed technical analysis of this vulnerability, refer to the WPScan Vulnerability Analysis and the WordPress Security Issue Bypass discussion.

Detection Methods for CVE-2021-24917

Indicators of Compromise

• Unusual HTTP requests to /wp-admin/options.php from unauthenticated sources
• HTTP requests with random or suspicious referer header values targeting WordPress admin endpoints
• Increased reconnaissance activity followed by direct access attempts to non-standard login URLs
• Web server logs showing sequential requests to /wp-admin/options.php followed by requests to the secret login page

Detection Strategies

• Monitor web server access logs for requests to /wp-admin/options.php with unusual referer headers
• Implement Web Application Firewall (WAF) rules to detect and block requests with manipulated referer patterns
• Deploy intrusion detection signatures that identify the specific attack pattern of random referer strings combined with options.php access
• Review WordPress access logs for patterns indicating login page discovery attempts

Monitoring Recommendations

• Enable detailed HTTP request logging including referer headers for WordPress admin directories
• Configure alerts for multiple failed authentication attempts following access to /wp-admin/options.php
• Implement rate limiting on /wp-admin/ endpoints to slow down reconnaissance activities
• Use SentinelOne Singularity platform to monitor for suspicious web application behavior patterns

How to Mitigate CVE-2021-24917

Immediate Actions Required

• Update WPS Hide Login plugin to version 1.9.1 or later immediately
• Audit web server logs for evidence of exploitation attempts against /wp-admin/options.php
• Consider changing your secret login URL after patching if you suspect prior exposure
• Implement additional authentication controls such as IP whitelisting or two-factor authentication

Patch Information

The vulnerability has been addressed in WPS Hide Login version 1.9.1 and later. Site administrators should update the plugin through the WordPress admin dashboard or via WP-CLI. After updating, verify the plugin version by checking the plugin details page.

For additional information, review the WordPress Security Issue Bypass discussion and the WPScan Vulnerability Analysis.

Workarounds

• Implement Web Application Firewall rules to block requests to /wp-admin/options.php with suspicious referer patterns
• Restrict access to /wp-admin/ directory at the web server level using IP-based allowlisting
• Add additional authentication layers such as HTTP Basic Authentication in front of the WordPress admin area
• Consider using alternative security plugins that do not rely solely on URL obfuscation for protection

# Example Apache .htaccess configuration to restrict wp-admin access by IP
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/options\.php
RewriteCond %{HTTP_REFERER} !^https://yourdomain\.com [NC]
RewriteRule .* - [F,L]
</IfModule>

# Example Nginx configuration to restrict access
location /wp-admin/options.php {
    allow 192.168.1.0/24;
    deny all;
}