Thalakus

Name of the Vulnerable Software and Affected Versions: WPS Hide Login WordPress plugin versions prior to 1.9.1 Description: The issue allows an unauthenticated user to discover the secret login page by setting a random referer string and making a request to /wp-admin/options.php. This can be exploited by navigating to the /wp-admin/options.php endpoint and potentially being redirected to the secret login page. Recommendations: For versions prior to 1.9.1, update to version 1.9.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /wp-admin/options.php endpoint to minimize the risk of exploitation.