CVE-2021-24917

HighPublished

WPS Hide Login < 1.9.1 - Protection Bypass with Referer-Header

Published: Dec 6, 2021
Updated: Aug 3, 2024
Assigning CNA: WPScan
Evidence observed: Aug 8, 2026

Primary CVSS

7.5/ 10High

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS probability estimate

72.2%

High · next 30 days

Percentile: 99.4%
Model date: Oct 19, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.

Sources

Repository evidence: Files: 2 · Repositories: 2

1 Module1 Template

WordPress WPS Hide Login Login Page RevealerModule
modules/auxiliary/scanner/http/wp_wps_hide_login_revealer.rb
Metasploit Framework modules
DetectionEvidence observed: Sep 26, 2026Revision: 1e321cedaf4cRelated tool
Declared conditions
- verification: check_not_declared($.auxiliary_scanner/http/wp_wps_hide_login_revealer.check)
WordPress WPS Hide Login <1.9.1 - Information DisclosureTemplate
http/cves/2021/CVE-2021-24917.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: ee9e6969a9beRelated tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl,word($.matchers[*].type)

CVE-2021-24917Scanner
WordPress WPS Hide Login <1.9.1 - Information Disclosure
CVE-2021-24917Exploit
CVE-2021-24917

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.