CVE-2024-6289: WPS Hide Login Auth Bypass Vulnerability

CVE-2024-6289 Overview

CVE-2024-6289 affects the WPS Hide Login WordPress plugin in versions before 1.9.16.4. The plugin conceals the standard WordPress login URL to reduce brute-force exposure. The vulnerability allows unauthenticated attackers to bypass this concealment by abusing the WordPress auth_redirect function. An attacker who crafts a specific request can trigger a redirect that reveals the hidden login page. This defeats the core security control the plugin is designed to provide.

Critical Impact
Unauthenticated remote attackers can discover the hidden WordPress login endpoint, negating the protection WPS Hide Login provides against automated brute-force and credential-stuffing attacks.

Affected Products

WPS Hide Login plugin for WordPress, all versions before 1.9.16.4
WordPress sites relying on WPS Hide Login as a login-obfuscation control
Deployments packaged by wpserveur distributing wps_hide_login

Discovery Timeline

2024-07-15 - CVE-2024-6289 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-6289

Vulnerability Analysis

WPS Hide Login replaces the default wp-login.php and wp-admin endpoints with a custom URL known only to administrators. The plugin intercepts requests to the standard endpoints and returns a 404 response for unauthenticated visitors. This obfuscation reduces exposure to automated login attacks against WordPress installations.

The flaw exists because the plugin fails to intercept redirects generated by the WordPress core auth_redirect() function. When WordPress calls auth_redirect() for a protected resource, it constructs a redirect to the login page and issues it to the client. The plugin does not sanitize or block this specific redirect flow for unauthenticated requests. As a result, the response reveals the custom login URL configured by the site administrator.

This is classified as an open redirect and information disclosure issue tracked under CWE-601. The impact is limited to confidentiality of the hidden endpoint and integrity of the security control, not direct code execution or data theft.

Root Cause

The root cause is incomplete request interception. WPS Hide Login hooks WordPress request handling to rewrite login-related URLs, but the hook coverage misses the auth_redirect code path. Any WordPress feature or plugin that invokes auth_redirect() on an unauthenticated visitor will emit the true login URL in the Location header.

Attack Vector

An unauthenticated attacker requests a WordPress resource that requires authentication and triggers auth_redirect(). The server responds with an HTTP redirect whose Location header contains the hidden login page URL. The attacker parses the header, extracts the URL, and proceeds with brute-force, credential stuffing, or targeted phishing against that endpoint. No user interaction on the target site is required beyond the initial crafted request. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2024-6289

Indicators of Compromise

HTTP 302 responses from WordPress endpoints containing the customized login slug in the Location header from unauthenticated sources
Spikes in requests to admin-only URLs such as /wp-admin/, /wp-admin/edit.php, or similar paths from unfamiliar IP addresses
Post-discovery login attempts against the previously hidden login URL from IPs that recently probed admin endpoints

Detection Strategies

Inspect web server access logs for redirect responses whose Location value matches the site's custom login slug
Correlate discovery-phase probes to /wp-admin/* with subsequent authentication traffic against the hidden URL
Deploy web application firewall rules that flag unauthenticated requests generating auth_redirect() responses

Monitoring Recommendations

Track the installed version of WPS Hide Login across all managed WordPress instances and alert on versions below 1.9.16.4
Monitor failed login attempts against the custom login URL and set thresholds for automated blocking
Ingest WordPress and web server logs into a centralized analytics platform to correlate reconnaissance and credential-attack patterns

How to Mitigate CVE-2024-6289

Immediate Actions Required

Update the WPS Hide Login plugin to version 1.9.16.4 or later on every WordPress site
Audit access logs for redirect responses that may have leaked the hidden login URL prior to patching
Rotate administrator passwords and enforce multi-factor authentication on all privileged accounts

Patch Information

The vendor released WPS Hide Login 1.9.16.4, which adds interception of the auth_redirect code path to prevent disclosure of the custom login URL. Administrators should update through the WordPress plugin dashboard or by installing the fixed release directly. Verify the installed version after update by checking the plugin metadata.

Workarounds

Restrict access to /wp-admin/ and /wp-login.php at the web server or WAF layer using IP allowlists for administrative networks
Enforce multi-factor authentication for all WordPress accounts so that login URL disclosure alone does not lead to account compromise
Deploy fail2ban or an equivalent rate-limiting control on the WordPress login endpoint to blunt brute-force attempts

bash

# Configuration example: nginx snippet restricting admin access by IP
location ~ ^/(wp-admin|wp-login\.php) {
    allow 203.0.113.0/24;   # trusted admin network
    deny all;
    try_files $uri $uri/ /index.php?$args;
}