CVE-2024-37881: SiteGuard WP Plugin Information Disclosure

CVE-2024-37881 Overview

CVE-2024-37881 is an information exposure vulnerability [CWE-201] in the SiteGuard WP Plugin for WordPress. The plugin lets administrators rename the login endpoint from wp-login.php to a custom path and blocks redirection from that legacy URL. Versions prior to 1.7.7 fail to apply the same protection to wp-register.php, allowing unauthenticated attackers to trigger a redirect that discloses the customized login path.

Critical Impact
Attackers can bypass the login-path obfuscation control by requesting wp-register.php, exposing the hidden login URL and undermining a primary anti-brute-force protection.

Affected Products

SiteGuard WP Plugin versions prior to 1.7.7
WordPress sites relying on SiteGuard's Rename Login feature
JP-Secure SiteGuard WP Plugin deployments

Discovery Timeline

2024-06-19 - CVE-2024-37881 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-37881

Vulnerability Analysis

The SiteGuard WP Plugin implements a Rename Login feature that replaces the default WordPress login endpoint with an administrator-defined path. To preserve the obfuscation, the plugin intercepts requests to wp-login.php and prevents WordPress from redirecting anonymous users to the renamed endpoint.

This protection is incomplete. The plugin does not apply the same interception to requests targeting wp-register.php. When user registration is enabled, requesting the register endpoint triggers WordPress's native redirect logic, which follows the renamed login path and returns it in the response.

The result is unauthorized disclosure of information the site owner intended to keep private. Once the hidden login URL is known, attackers can resume credential-stuffing, brute-force, and enumeration attacks that Rename Login was deployed to mitigate.

Root Cause

The root cause is missing redirection control in the siteguard-rename-login.php class for the wp-register.php entry point. The developer applied the guard to wp-login.php only, leaving a parallel WordPress code path unprotected. Refer to the WordPress SiteGuard Change Log for the corrective patch.

Attack Vector

An unauthenticated remote attacker issues an HTTP request to wp-register.php on the target WordPress site. WordPress follows its default handling and issues a redirect that leaks the renamed login URL configured by SiteGuard. No user interaction or credentials are required. See the JP-Secure Vulnerability Advisory and the JVN Vulnerability Report for advisory details.

Detection Methods for CVE-2024-37881

Indicators of Compromise

Unauthenticated HTTP GET requests to /wp-register.php from external sources
HTTP 301 or 302 responses from wp-register.php containing a non-default Location header pointing to the renamed login path
Subsequent authentication attempts against the disclosed custom login URL from the same client IP

Detection Strategies

Inspect web server access logs for wp-register.php requests followed by traffic to the customized login path from the same source IP
Correlate 3xx responses referencing the renamed login endpoint with clients that never previously accessed it
Alert on brute-force patterns against custom login paths that immediately follow wp-register.php probes

Monitoring Recommendations

Enable verbose access logging on the WordPress front-end web server and forward logs to a central analytics platform
Track the installed version of the SiteGuard WP Plugin across all managed WordPress sites
Monitor failed authentication counts at the renamed login endpoint for anomalies after wp-register.php traffic

How to Mitigate CVE-2024-37881

Immediate Actions Required

Upgrade the SiteGuard WP Plugin to version 1.7.7 or later on every affected WordPress installation
Audit the WordPress users_can_register setting and disable open registration where it is not required
Review web server logs for prior requests to wp-register.php and treat any renamed login URL as potentially disclosed

Patch Information

JP-Secure addressed the issue in SiteGuard WP Plugin 1.7.7 by adding redirection controls for wp-register.php in classes/siteguard-rename-login.php. Review the code change in the WordPress SiteGuard Change Log and the vendor notice in the JP-Secure Vulnerability Advisory.

Workarounds

Disable user registration in WordPress by unchecking Settings → General → Membership until the plugin is patched
Block direct external access to /wp-register.php at the web server or WAF layer
Restrict access to the renamed login page with IP allow-lists or HTTP basic authentication as a defense-in-depth control

bash

# Apache: block external access to wp-register.php as a temporary workaround
<Files "wp-register.php">
    Require all denied
</Files>

# Nginx equivalent
location = /wp-register.php {
    deny all;
    return 403;
}