A new WordPress plugin vulnerability has been discovered that could allow an attacker to gain access to a site’s administrator login page.
The vulnerability exists in the popular WPS Hide Login plugin and was discovered by a user with the handle thalakus who posted a brief description of the issue on WordPress.org’s support forum.
Ironically, this vulnerability defeats the purpose of the plugin which hides a WordPress site’s administrator login page and makes the wp-admin directory inaccessible.
As over one million WordPress sites use WPS Hide Login to add a deeper layer of security, users of this plugin should upgrade to the latest version now to prevent any attackers from exploiting this vulnerability.
Hiding the administrator login page
While WPS Hide Login and can be used to hide a…
Source link
