WordPress CVEs

Description

The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request

Affected WordPress components

• wp-hide Plugin · wp-hide
  Confirmed match Homeless
  From 0.0.2 (including) to 0.0.2 (including)
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Wp-Hide — From 0.0.2 (including) to 0.0.2 (including)
• weberge wp_hide — Up to and including 0.0.2

References

• wpscan.com https://wpscan.com/vulnerability/36d78b6c-0da5-44f8-b7b3-eae78edac505 Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record