CVE-2024-2473

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

• CWE-863

• https://github.com/whattheslime/wps-show-login
• https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-loginPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/changeset/3099109/wps-hide-loginPatch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/fd21c7d3-a5f1-4c3a-b6ab-0a979f070a62?source=cveThird Party Advisory

Published

Jun 11, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-2472The LatePoint Plugin plugin for WordPress is vulnerable to u…9.1
• CVE-2024-24720An issue was discovered in the Forgot password function in I…5.3
• CVE-2024-24721An issue was discovered on Innovaphone PBX before 14r1 devic…6.5
• CVE-2024-24722An unquoted service path vulnerability in the 12d Synergy Se…9.1
• CVE-2024-24724Gibbon through 26.0.00 allows /modules/School%20Admin/messen…9.8
• CVE-2024-24725Gibbon through 26.0.00 allows remote authenticated users to …8.8
• CVE-2024-24731This vulnerability allows network-adjacent attackers to exec…8.8
• CVE-2024-24736The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remo…7.5
• CVE-2024-24739SAP Bank Account Management (BAM) allows an authenticated us…6.3
• CVE-2024-2474The Standout Color Boxes and Buttons plugin for WordPress is…6.4
• CVE-2024-24740SAP NetWeaver Application Server (ABAP) - versions KERNEL 7.…5.3
• CVE-2024-24741SAP Master Data Governance for Material Data - versions 618,…4.3