CVE-2019-15824

Vulnerability

The wps-hide-login plugin for WordPress versions before 1.5.3 contains an authentication bypass vulnerability in the adminhash protection mechanism. The flaw resides in file /classes/plugins.php at lines 477-480. When the plugin checks for admin access, it redirects non-logged-in users away from wp-admin, but the code includes a condition that if the adminhash parameter is present in the URL ($_GET['adminhash']), the redirect is skipped, allowing direct access to the admin dashboard [2]. No special configuration beyond installing the plugin is required for the vulnerable code path to be reachable.

Exploitation

An unauthenticated attacker can exploit this bypass simply by appending ?adminhash=1 (or any non-empty value) to a URL pointing to the WordPress admin area, for example https://example.com/wp-admin/?adminhash=1 [2]. No authentication, user interaction, or specific network position is needed. The attacker only needs to know the site's WordPress address; the adminhash parameter triggers the bypass regardless of the plugin's custom login URL.

Impact

Successful exploitation grants the attacker unrestricted access to the WordPress admin dashboard (/wp-admin/) without requiring any credentials [2]. This effectively bypasses the plugin's core security feature that hides the login URL and restricts admin access. An attacker with admin panel access can then perform any administrative action, including modifying themes/plugins, creating new admin users, or injecting malicious content, leading to complete site compromise.

Mitigation

A fix was released in version 1.5.3 of the wps-hide-login plugin [1]. Users should immediately update to version 1.5.3 or later through the WordPress plugin repository. As of the publication date (2019-08-30), no workarounds were documented; the only mitigation is to upgrade the plugin. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.