CVE-2026-84168: Easy Hide Login WordPress Auth Bypass Flaw

CVE-2026-84168 Overview

CVE-2026-84168 affects the Easy Hide Login WordPress plugin in versions prior to 1.7. The plugin fails to fully enforce its hidden-login protection, allowing unauthenticated attackers to reach the standard WordPress login page through crafted password-reset request parameters. Once accessed, the returned page discloses the site's configured secret login slug, defeating the plugin's core protection mechanism. The vulnerability is classified as an Information Disclosure issue under CWE-200.

Critical Impact
Unauthenticated attackers can recover the secret login URL configured by Easy Hide Login, exposing the WordPress admin login page to brute-force and credential-stuffing attacks.

Affected Products

Easy Hide Login WordPress plugin versions prior to 1.7
WordPress sites relying on Easy Hide Login for login URL obfuscation
Deployments that treat the hidden login slug as a defensive control

Discovery Timeline

2026-09-23 - CVE-2026-84168 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-84168

Vulnerability Analysis

Easy Hide Login is designed to replace the default /wp-login.php and /wp-admin endpoints with a secret slug chosen by the site administrator. Requests to the standard login endpoints should be rejected or redirected. The plugin's request-filtering logic does not cover all execution paths in the WordPress authentication flow.

Specifically, certain password-reset request parameters bypass the endpoint-hiding checks. The plugin allows the request to proceed to the native login page rendering, and the returned HTML contains references that reveal the configured secret slug. An unauthenticated remote attacker can therefore deobfuscate the hidden login URL with a single HTTP request.

Root Cause

The root cause is incomplete enforcement of the hidden-login guard on WordPress password-reset request flows. The plugin filters direct access to the login endpoint but does not sanitize or block reset-flow parameters that ultimately render the same login view. The returned page then leaks the secret slug through embedded links or form actions, satisfying the conditions for [CWE-200] Information Exposure.

Attack Vector

The attack is network-based, requires no authentication, and requires no user interaction. An attacker sends a crafted password-reset request to the target WordPress site. The server responds with the login page, and the response body contains the secret login slug. The attacker parses the response to recover the slug and gains direct access to the hidden login URL for follow-on attacks such as credential brute-force or username enumeration.

No verified public proof-of-concept code is available at time of publication. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-84168

Indicators of Compromise

Unauthenticated HTTP GET or POST requests to WordPress password-reset endpoints containing atypical parameter combinations from external IP addresses.
Access log entries showing the hidden login slug being requested from IPs that never previously interacted with the site.
Spikes in failed authentication attempts against the hidden login URL shortly after password-reset request traffic.

Detection Strategies

Monitor WordPress access logs for password-reset requests originating from unauthenticated sources followed by requests to the secret login slug.
Deploy web application firewall (WAF) rules that flag requests to wp-login.php with reset-flow parameters when Easy Hide Login is active.
Correlate reconnaissance patterns using an SIEM to identify low-volume slug discovery followed by high-volume login attempts.

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF to capture full query strings on authentication endpoints.
Alert on any successful HTTP 200 response served from wp-login.php when the request should have been rewritten by the plugin.
Track distinct client IPs that access the hidden login slug for the first time and rank them by subsequent authentication attempts.

How to Mitigate CVE-2026-84168

Immediate Actions Required

Upgrade the Easy Hide Login plugin to version 1.7 or later on all WordPress installations.
Rotate the configured secret login slug after upgrading, since prior slugs may already be exposed.
Enforce strong, unique administrator passwords and enable multi-factor authentication on all privileged WordPress accounts.

Patch Information

The vendor addressed the issue in Easy Hide Login version 1.7. The fix extends the plugin's request-filtering logic to cover password-reset request parameters, preventing the standard login page from being rendered and preventing the secret slug from being disclosed. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Restrict access to wp-login.php and password-reset endpoints at the web server or WAF layer using IP allowlisting where operationally feasible.
Deploy a secondary authentication control such as HTTP Basic Auth in front of the WordPress login and reset endpoints.
Treat the hidden login slug as an obfuscation aid only, not as a security boundary, and layer rate limiting and MFA on all authentication endpoints.

bash

# Example Nginx snippet: restrict password-reset flow to trusted IPs
location = /wp-login.php {
    allow 203.0.113.0/24;
    deny all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}