CVE-2019-15826

Vulnerability

The WPS Hide Login plugin for WordPress, versions before 1.5.3, contains a protection bypass vulnerability. The plugin attempts to hide the default WordPress login page by renaming the login URL. However, it fails to properly validate the Referer header, allowing an attacker to access the standard wp-login.php page by including the string "wp-login.php" anywhere in the Referer field of an HTTP request. The vulnerability is present in the plugin's code that checks the Referer header, as described in reference [2].

Exploitation

An attacker can exploit this vulnerability by sending an HTTP request to https://example.com/wp-login.php?action=postpass (or a similar endpoint) with a crafted Referer header containing the string "wp-login.php". The attack requires no authentication and can be performed remotely. The attacker simply needs to manipulate the Referer header in their HTTP request; no special network position or user interaction is needed. The WordPress core will then process the request and allow access to the login page due to the flawed Referer check in the plugin.

Impact

Successful exploitation allows an attacker to bypass the hidden login URL protection and access the standard WordPress login page (wp-login.php). This exposes the login form, which can then be used for brute-force attacks or other credential-based attacks against the site. The impact is a bypass of a security-by-obscurity measure, increasing the attack surface for the WordPress site.

Mitigation

Users should update the WPS Hide Login plugin to version 1.5.3 or later, which contains the fix for this vulnerability. As of the publication date, version 1.5.3 was the patched release [1]. Administrators should ensure automatic updates are enabled for the plugin. There is no known workaround for sites running older versions, as the vulnerability is in the core logic of the plugin.