Description

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-23T06:17:03.280Z",
  "pubdate": "2026-09-23T06:17:03.280Z",
  "executiveSummary": "The Easy Hide Login WordPress plugin, in versions prior to 1.7, is susceptible to an information disclosure vulnerability that compromises its core security objective. The plugin is designed to obscure the WordPress administrative login page to prevent unauthorized access and brute-force attacks. However, due to insufficient enforcement of this protection, an unauthenticated remote attacker can bypass the intended restrictions.\nThe vulnerability manifests when specific parameters related to password-reset requests are submitted to the server. This interaction allows an attacker to force the application to render the default login interface, which would otherwise be hidden. More critically, the server response contains the site's secret login slug, effectively nullifying the security-through-obscurity mechanism provided by the plugin.\nThis flaw grants an unauthenticated attacker the ability to identify the concealed URL path required to access the login page. By defeating this obfuscation, the attacker gains the necessary information to target the authentication interface directly. The risk to the site is elevated, as it removes the primary hurdle preventing automated scanning and brute-force attempts against the WordPress administrative credentials. This vulnerability requires no prior authentication or administrative privileges to exploit.",
  "technicalDetails": "The root cause of this vulnerability lies in a flaw within the request handling logic of the Easy Hide Login plugin prior to version 1.7. Specifically, the plugin fails to properly validate or restrict access to the underlying WordPress authentication page when certain URI parameters—specifically those associated with the password-recovery workflow—are invoked by a user agent.\nUnder normal operating conditions, the plugin interceptors are configured to redirect or block requests to 'wp-login.php' and other administrative access points if the correct secret slug is not provided. However, the implementation does not comprehensively account for the state-handling of password-reset requests. When an attacker sends a crafted request containing these specific password-reset parameters, the plugin's security filter incorrectly permits the request to proceed to the native WordPress authentication component.\nThe attack flow proceeds as follows: 1) The attacker initiates a request to the WordPress site including parameters designated for password reset actions. 2) The plugin's security middleware fails to intercept this request as a standard login attempt or fails to sanitize the response appropriately. 3) The backend server processes the request and serves the default login page content to the user. 4) The server response, which is returned to the unauthenticated attacker, includes metadata or URI references that explicitly expose the configured custom login slug. 5) By parsing the HTML or HTTP response headers, the attacker identifies the exact URL structure the plugin intended to hide.\nThis exposure of the secret slug effectively renders the plugin's protection mechanism obsolete. Once the slug is discovered, the attacker can bypass the concealment feature and interact with the standard authentication endpoint, facilitating further attacks such as credential stuffing, brute-forcing, or potential exploitation of other vulnerabilities in the login process. The vulnerability is triggered entirely via remote, unauthenticated HTTP requests, requiring no specific user interaction or elevated access levels. Because this flaw exists within the plugin's routing and security filtering layer, it is consistently reproducible across all installations of Easy Hide Login versions earlier than 1.7."
}