Description

WordPress Plugin WPS Hide Login is prone to a cross-site request forgery vulnerability. Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application; other attacks are also possible. WordPress Plugin WPS Hide Login version 1.0 is vulnerable.

Remediation

Update to plugin version 1.1 or latest

References

https://wordpress.org/plugins/wps-hide-login/changelog/

Related Vulnerabilities

WordPress Plugin Visualizer:Tables and Charts Manager for WordPress Multiple Vulnerabilities (3.3.0)

WordPress Plugin My Calendar Multiple Vulnerabilities (2.3.29)

WordPress Plugin Simply Poll SQL Injection (1.4.1)

Roundcube Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-47272)

WordPress Plugin Pierre's Wordspew 'wordspew.php' Multiple SQL Injection Vulnerabilities (5.61)

Severity

High

Classification

CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update CSRF