PatchTheCVECVE-2024-2473: The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and incl
CVE-2024-2473 is a medium-severity flaw (CVSS 5.3) affecting wps hide login. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.2% (top 31%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2024-06-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: WPS Hide Login <= 1.9.15.2 - Login Page Disclosure
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-2473?
wps hide login: upgrade to 1.9.16. Exact commands for each OS are on this page.
Is CVE-2024-2473 being exploited?
CVE-2024-2473 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-2473 affect?
CVE-2024-2473 affects wps hide login. Severity is medium (CVSS 5.3). The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible
How urgent is CVE-2024-2473?
Priority 41/100. Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2024-6289 MEDIUM 6.1 UPGRADE The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_
- CVE-2020-36710 MEDIUM 5.3 UPGRADE The WPS Hide Login plugin for WordPress is vulnerable to login page disclosure even when the settings of the p