CVE-2024-2473: WPS Hide Login Auth Bypass Vulnerability

CVE-2024-2473 Overview

The WPS Hide Login plugin for WordPress contains an authorization bypass vulnerability that exposes hidden login pages. The flaw affects all versions up to and including 1.9.15.2. Attackers can bypass the plugin's login page concealment by appending the action=postpass parameter to requests. This defeats the plugin's primary security feature, which is designed to hide the WordPress login URL from unauthorized visitors.

The vulnerability is tracked under CWE-863: Incorrect Authorization and enables unauthenticated remote attackers to enumerate hidden administrative endpoints across affected WordPress installations.

Critical Impact
Unauthenticated attackers can discover hidden WordPress login pages by adding a single URL parameter, enabling downstream credential attacks against administrative interfaces.

Affected Products

WPS Hide Login plugin for WordPress, versions up to and including 1.9.15.2
WordPress sites relying on WPS Hide Login for login URL obfuscation
Deployments using the wpserveur:wps_hide_login component

Discovery Timeline

2024-06-11 - CVE-2024-2473 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2473

Vulnerability Analysis

WPS Hide Login is a WordPress plugin that changes the URL of the login form page to a custom path chosen by the administrator. Its purpose is to reduce automated brute-force and credential-stuffing traffic against the default wp-login.php endpoint. The plugin intercepts requests to the login page and blocks direct access unless the user knows the custom URL.

The vulnerability stems from an incomplete authorization check inside the request-handling logic. When a request includes the action=postpass parameter, the plugin does not enforce its redirection and blocking logic. This parameter is normally associated with WordPress password-protected post functionality. The plugin treats the request as legitimate and serves the login page from the underlying wp-login.php handler.

Because the check occurs before the login page hide logic runs, the concealment is bypassed entirely. Attackers do not need credentials, user interaction, or elevated privileges to exploit the flaw.

Root Cause

The root cause is an authorization logic error [CWE-863]. The plugin's conditional gating fails to account for requests containing action=postpass, which reaches the login handler without triggering the hide mechanism. The fix, published in changeset 3099109, adds handling for this parameter path so requests are evaluated consistently.

Attack Vector

Exploitation requires only an HTTP GET request to the standard wp-login.php endpoint with the action=postpass query parameter appended. If the response returns the login form rather than a redirect or 404, the target site is running a vulnerable version. Automated scanners can enumerate affected sites across the internet with minimal effort.

A vulnerable request pattern takes the form https://target.example/wp-login.php?action=postpass. The response reveals the hidden login interface. Attackers then pivot to credential attacks, username enumeration, or exploitation of other WordPress authentication weaknesses. Public proof-of-concept tooling is available at the wps-show-login GitHub repository.

Detection Methods for CVE-2024-2473

Indicators of Compromise

HTTP requests to wp-login.php containing the action=postpass query parameter from unrecognized source IP addresses
Bursts of scanning traffic probing WordPress endpoints for hidden login pages
Successful HTTP 200 responses to wp-login.php?action=postpass when the plugin's custom path should return a redirect

Detection Strategies

Inspect web server access logs for the string action=postpass combined with requests to wp-login.php or wp-admin paths
Deploy WordPress security plugins or web application firewall rules that flag the postpass bypass pattern
Correlate login page disclosure attempts with subsequent authentication failures to identify staged credential attacks

Monitoring Recommendations

Enable centralized logging for all WordPress-hosting web servers and forward events to a SIEM for correlation
Alert on repeated requests to authentication endpoints from a single source within short time windows
Track outbound plugin version reporting to identify WordPress instances still running WPS Hide Login 1.9.15.2 or earlier

How to Mitigate CVE-2024-2473

Immediate Actions Required

Update the WPS Hide Login plugin to a version newer than 1.9.15.2 that incorporates the fix from changeset 3099109
Audit web server access logs for prior exploitation attempts using the action=postpass parameter
Rotate WordPress administrator credentials if login page disclosure is confirmed and brute-force activity followed

Patch Information

The plugin maintainer released a fix committed in WordPress Plugin Repository changeset 3099109. Administrators should upgrade through the WordPress plugin update mechanism. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

Add a web application firewall rule that blocks requests to wp-login.php containing action=postpass when the request does not originate from a legitimate password-protected post flow
Enforce IP allowlisting on the WordPress administrative interface using web server configuration
Layer additional authentication controls such as HTTP basic authentication or multi-factor authentication in front of the login page to reduce reliance on URL obscurity

bash

# Example nginx rule to block the bypass pattern until patching is complete
location = /wp-login.php {
    if ($arg_action = "postpass") {
        return 403;
    }
}