CVE-2019-15823

Vulnerability

The wps-hide-login plugin for WordPress, versions before 1.5.3, fails to properly restrict access to the default WordPress login page (wp-login.php) and admin area (/wp-admin/). The plugin attempts to hide the login URL but contains multiple protection bypass flaws. Specifically, the plugin checks for the presence of the string action=confirmaction in a request query without proper validation [1][2]. An attacker can include this string in a URL to bypass the plugin's redirection and gain direct access to wp-login.php [2].

Exploitation

An attacker can exploit this vulnerability remotely without authentication. By simply appending action=confirmaction to any query parameter in a request to wp-login.php, for example https://example.com/wp-login.php?SECUPRESSaction=confirmaction, the plugin's code will include wp-login.php directly, bypassing the intended custom login page [2]. No special network position or user interaction is required beyond the ability to send HTTP requests to the WordPress site.

Impact

Successful exploitation allows an attacker to access the standard WordPress login page. While this alone does not compromise an account, it defeats the security-through-obscurity measure provided by the plugin. This can expose the login form to brute-force attacks, enumeration attempts, and other login-page-based attacks that the plugin was designed to mitigate [1][2].

Mitigation

The vulnerability is fixed in plugin version 1.5.3 [1]. Administrators should update the WPS Hide Login plugin to version 1.5.3 or later immediately. There is no known workaround short of disabling the plugin until it is updated. This CVE is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.