# CVE-2024-2473: WPS Hide Login - Information Disclosure

> Live exploitation tracking for CVE-2024-2473 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-2473

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.3
- **Public exploit available:** Yes
- **Affected products:** Tabrisrp WPS Hide Login
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** wordpress, cms

## Description

The WPS Hide Login plugin for WordPress is vulnerable to Login Page Disclosure in all versions up to, and including, 1.9.15.2. This is due to a bypass that is created when the 'action=postpass' parameter is supplied. This makes it possible for attackers to easily discover any login page that may have been hidden by the plugin.

## CrowdSec analysis

[CVE-2024-2473](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-2473) is an information disclosure vulnerability in the WPS Hide Login plugin for WordPress, affecting all versions up to 1.9.15.2. By exploiting a flaw involving the 'action=postpass' parameter, attackers can easily bypass the plugin's protections and reveal the hidden login page. This exposure increases the risk of targeted brute-force or credential stuffing attacks against WordPress sites that rely on this plugin for login page obfuscation.

CrowdSec has been tracking this vulnerability and its exploits since 14th of January 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2024-2473 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers probe for hidden WordPress login pages by sending requests with the `action=postpass` parameter to endpoints like `/wp-login.php` and `/wp-admin/`, exploiting a bypass in the WPS Hide Login plugin to reveal or redirect to the actual login page.

## Timeline

- 2024-06-11: CVE Published. CVE-2024-2473 is published to NVD.
- 2026-01-14: Rule Released. CrowdSec releases a rule to detect CVE-2024-2473 exploitation attempts against the CrowdSec Network.
- 2026-01-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-2473 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-2473.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-2473) follows observed exploitation activity for CVE-2024-2473. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.