WPS Hide Login - Information Disclosure (CVE-2024-2473)
Description
The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.
psychologyCrowdSec Analysis
CVE-2024-2473 is an information disclosure vulnerability in the WPS Hide Login plugin for WordPress, affecting all versions up to 1.9.15.2. By exploiting a flaw involving the 'action=postpass' parameter, attackers can easily bypass the plugin's protections and reveal the hidden login page. This exposure increases the risk of targeted brute-force or credential stuffing attacks against WordPress sites that rely on this plugin for login page obfuscation.
CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2024-2473 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers probe for hidden WordPress login pages by sending requests with the action=postpass parameter to endpoints like /wp-login.php and /wp-admin/, exploiting a bypass in the WPS Hide Login plugin to reveal or redirect to the actual login page.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-06-11 |
| Rule Released | 2026-01-14 |
| CrowdSec First Seen | 2026-01-23 |