CVE-2026-84168 in Easy Hide Login Plugin
Summary
by MITRE • 09/23/2026
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified in versions of the Easy Hide Login WordPress plugin prior to version 1.7 represents a critical failure in access control mechanisms designed to obscure administrative entry points. The primary function of this security plugin is to mask the default wp-login.php path, thereby reducing the attack surface by preventing automated bots and casual attackers from locating the login interface. However, due to insufficient validation logic within the password reset functionality, an unauthenticated attacker can bypass this obfuscation layer entirely. By manipulating specific parameters associated with password recovery requests, such as those used in the wp-login.php?action=lostpassword flow, the application fails to restrict access appropriately and instead reveals sensitive configuration details that were intended to remain hidden from public view.
From a technical perspective, the flaw stems from improper input validation and state management within the plugin's handling of user authentication flows. When an attacker submits a request containing specific password-reset parameters, the server processes this request without adequately checking whether the requested action aligns with the security policies enforced by the hiding mechanism. Consequently, instead of returning a generic error or redirecting to a safe page as intended for hidden login scenarios, the application returns a response that includes the actual secret slug configured in the plugin settings. This behavior effectively neutralizes the core protection feature because it allows an external observer to discover the exact URL required to access the administrative dashboard without prior knowledge of the custom path.
The operational impact of this vulnerability is significant for any WordPress site relying on Easy Hide Login as its primary defense against brute-force attacks and credential stuffing attempts. Once the secret login slug is exposed, the attacker gains a direct pathway to the authentication interface. This enables subsequent phases of an attack chain, including dictionary-based password guessing, multi-factor authentication bypass if implemented incorrectly, or exploitation of other vulnerabilities present in the admin panel itself. The exposure undermines the principle of security through obscurity by making it trivial for adversaries to locate the entry point, thereby increasing the likelihood of successful unauthorized access and potential full site compromise.
This issue aligns with CWE-284, which describes Improper Access Control, specifically where a system fails to restrict access to resources based on user identity or role. Furthermore, in the context of the MITRE ATT&CK framework, this vulnerability facilitates the Reconnaissance phase by allowing attackers to discover valid login URLs and potentially enumerate usernames through error messages returned during the password reset process. It also supports the Initial Access phase by providing a known vector for brute-force attacks against administrative credentials. The lack of proper enforcement means that even if other security measures are in place, the foundational step of hiding the attack surface is compromised.
To mitigate this vulnerability, administrators must immediately upgrade the Easy Hide Login plugin to version 1.7 or later, where these access control checks have been corrected. Until an update can be applied, it is advisable to implement additional server-side restrictions such as IP whitelisting for the wp-admin directory and login pages using web application firewall rules. Enabling two-factor authentication adds a critical layer of defense that remains effective even if the login URL is discovered. Regular security audits and monitoring for unusual access patterns to administrative endpoints can also help detect exploitation attempts early, ensuring that any attempt to probe or abuse these parameters is identified and blocked before credentials are compromised.