CVE-2021-24917 — AI Deep Analysis Summary

🚨 **Essence**: A bug in 'WPS Hide Login' plugin allows attackers to bypass the hidden admin URL. 📉 **Consequences**: The secret login page is exposed, leading to unauthorized access risks.

🛡️ **CWE-863**: Incorrect Authorization. 🐛 **Flaw**: The plugin fails to validate the 'Referer' header properly. A random string bypasses the security check.

📦 **Product**: WordPress Plugin 'WPS Hide Login'. 📅 **Version**: Versions **before 1.9.1** are affected. 🌐 **Platform**: WordPress sites using this specific plugin.

🕵️ **Action**: Attackers request `/wp-admin/options.php` with a fake Referer. 🔓 **Result**: They reveal the **secret login location**. This exposes the admin entry point to brute-force or credential stuffing.

📉 **Threshold: LOW**. 🔑 **Auth**: No authentication required. 🌐 **Config**: Only needs a simple HTTP request with a random Referer header. Very easy to automate.

🔥 **Yes, Public**. 📂 **PoCs**: Multiple GitHub repositories exist (e.g., Cappricio-Securities, ProjectDiscovery Nuclei templates). 🛠️ **Status**: Actively exploitable in the wild.

🔍 **Check**: Scan for `/wp-admin/options.php` with a random Referer. 📡 **Tools**: Use Nuclei templates or custom scripts to detect if the hidden login URL is returned in the response.

✅ **Fixed**: Yes. 🔄 **Patch**: Upgrade 'WPS Hide Login' to **version 1.9.1 or later**. The vendor has addressed the Referer validation bug.

🚧 **Workaround**: If you cannot update immediately: 1. Disable the plugin. 2. Use a different security plugin. 3. Implement WAF rules to block suspicious Referer patterns.

⚡ **Priority: HIGH**. 🚨 **Urgency**: Since it requires no auth and has public exploits, immediate patching is critical to prevent admin panel discovery.