CrowdSecLive Exploit Tracker
Limited ExploitationCVE-2019-15823Public Exploit

WPS Hide Login Plugin - Authorization Bypass (CVE-2019-15823)

PublishedAug 30, 2019
First SeenAug 18, 2026
Last Seen
Reported
CVSS9.8
T
TabrisrpWPS Hide Login
wordpresscms

Description

The wps-hide-login plugin before 1.5.3 for WordPress has an action=confirmaction protection bypass.

psychologyCrowdSec Analysis

CVE-2019-15823 is a critical authorization bypass vulnerability in the wps-hide-login plugin for WordPress versions prior to 1.5.3. This flaw allows remote attackers to circumvent the plugin's protection mechanisms, potentially enabling unauthorized access to sensitive areas of a WordPress site and increasing the risk of site compromise.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2019-15823 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit this vulnerability by sending crafted requests to /wp-login.php with the SECUPRESSaction=confirmaction parameter, allowing them to bypass WPS Hide Login protections and access the default WordPress login page.

lock

Full Intelligence Available

Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.

EventDate
CVE Published2019-08-30
Rule Released2026-01-14
CrowdSec First Seen2026-08-18

Related Weaknesses

CWE-264: Permissions, Privileges, and Access Controls

Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

arrow_forward

Remediation & Protection

lock to download blocklists, subscribe to firewalls, and access IP intelligence.

External References