CVE-2024-6289: Wpserveur WPS Hide Login

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

The WPS Hide Login WordPress plugin before 1.9.16.4 does not prevent redirects to the login page via the auth_redirect WordPress function, allowing an unauthenticated visitor to access the hidden login page.

Affected products

• Wpserveur WPS Hide Login: before 1.9.16.4 (fixed in 1.9.16.4)

Published 2024-07-15. Last modified 2026-06-17.