CVE-2024-13794: Hide My WP Ghost Login Page Disclosure Flaw

CVE-2024-13794 Overview

CVE-2024-13794 affects the WP Ghost (Hide My WP Ghost) Security & Firewall plugin for WordPress. The plugin aims to hide the WordPress login page from unauthenticated users to reduce brute-force exposure. All versions up to and including 5.3.02 fail to properly restrict access to the /wp-register.php path. Unauthenticated attackers can request this path to disclose the hidden login page location, defeating the plugin's core security control. The flaw is categorized under [CWE-693: Protection Mechanism Failure].

Critical Impact
Unauthenticated attackers can bypass the login-page concealment feature and discover the hidden WordPress login URL, re-enabling brute-force and credential-stuffing attempts against administrator accounts.

Affected Products

WP Ghost (Hide My WP Ghost) Security & Firewall plugin for WordPress
All versions up to and including 5.3.02
WordPress installations relying on the plugin for login-page concealment

Discovery Timeline

2025-02-12 - CVE-2024-13794 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13794

Vulnerability Analysis

The WP Ghost plugin replaces the default WordPress login endpoints (wp-login.php, wp-admin) with a custom hidden path. Its purpose is to obscure the authentication surface from automated scanners and brute-force bots. The plugin enforces this restriction on multiple WordPress entry points but omits proper handling of /wp-register.php. When an unauthenticated attacker requests /wp-register.php, the plugin fails to apply its concealment logic. The server response discloses the hidden login page location, typically through a redirect or reference embedded in the response. This undermines the single security control the plugin exists to provide and returns the site to its pre-plugin exposure level for login-related attacks.

Root Cause

The root cause is incomplete coverage of WordPress authentication-related paths within the plugin's request-filtering layer. The plugin's path rewrite and access-restriction rules handle wp-login.php and administrative URLs but do not include wp-register.php in the protected set. Because WordPress treats registration and login as related flows, references to the concealed login URL leak through the registration endpoint. This is a classic [CWE-693] protection mechanism failure: the control exists but does not cover all code paths it is intended to defend.

Attack Vector

Exploitation requires only network access to the target WordPress site. An unauthenticated attacker issues an HTTP GET request to https://target.example.com/wp-register.php and inspects the response for the concealed login URL. Automated reconnaissance tooling can probe large numbers of sites running the plugin in a single sweep. Once the hidden path is known, attackers resume standard brute-force, password-spray, and credential-stuffing attacks against WordPress accounts. No authentication, user interaction, or special configuration is required.

No verified public proof-of-concept code is available. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13794

Indicators of Compromise

Unauthenticated HTTP requests to /wp-register.php originating from scanner user-agents or unknown IP ranges
Spikes in HTTP 301/302 redirect responses from /wp-register.php to a non-default login path
Subsequent authentication attempts against a previously concealed login URL from the same source IPs
Repeated failed login attempts following reconnaissance against /wp-register.php

Detection Strategies

Review web server access logs for requests to /wp-register.php from clients that do not follow a normal registration workflow
Correlate requests against /wp-register.php with later POST requests to the concealed login path from the same source
Deploy a WAF rule to flag or block unauthenticated access to /wp-register.php when user registration is disabled
Track the installed version of the WP Ghost plugin across managed WordPress sites and alert on versions at or below 5.3.02

Monitoring Recommendations

Enable verbose HTTP logging on the WordPress reverse proxy or web server and retain at least 30 days of request history
Alert on bursts of 4xx/3xx responses from authentication-adjacent paths including /wp-login.php, /wp-register.php, and the custom hidden path
Monitor WordPress audit logs for failed login attempts following reconnaissance activity

How to Mitigate CVE-2024-13794

Immediate Actions Required

Upgrade the WP Ghost (Hide My WP Ghost) plugin to the version released after 5.3.02 that restricts /wp-register.php
Audit all managed WordPress sites to inventory plugin versions and prioritize patching for internet-facing instances
Disable WordPress user registration (Settings > General > uncheck "Anyone can register") if not required
Enforce strong administrator passwords and multi-factor authentication to limit the impact of login-page disclosure

Patch Information

The vendor addressed the issue in a plugin update following version 5.3.02. Review the WordPress Change Log Entry for the specific code changes that extend path restrictions to /wp-register.php. Update the plugin through the WordPress admin dashboard or via WP-CLI.

Workarounds

Block or redirect unauthenticated requests to /wp-register.php at the web server or WAF layer until the plugin is updated
Apply IP allow-listing to the WordPress login path for administrative users where feasible
Deploy rate limiting on authentication endpoints to reduce the value of any disclosed login URL

bash

# Nginx example: deny unauthenticated access to wp-register.php
location = /wp-register.php {
    deny all;
    return 404;
}

# Apache .htaccess equivalent
<Files "wp-register.php">
    Require all denied
</Files>

# WP-CLI update after patch release
wp plugin update hide-my-wp