A new WordPress plugin vulnerability has been discovered that could allow an attacker to gain access to a site’s administrator login page.
The vulnerability exists in the popular WPS Hide Login plugin and was discovered by a user with the handle thalakus who posted a brief description of the issue on WordPress.org’s support forum.
Ironically, this vulnerability defeats the purpose of the plugin which hides a WordPress site’s administrator login page and makes the wp-admin directory inaccessible.
As over one million WordPress sites use WPS Hide Login to add a deeper layer of security, users of this plugin should upgrade to the latest version now to prevent any attackers from exploiting this vulnerability.
Hiding the administrator login page
While WPS Hide Login and can be used to hide a site’s administrator login page, there’s actually another way to do so without having to install a separate WordPress plugin according to Search Engine Journal.
As hackers and bots trying to attack a WordPress site’s login page often look in its default location, installing WordPress into a directory folder with a random name can be used to achieve the same outcome. So instead of housing the login page at /wp-login.php, you can install it into a directory folder with a random name so it appears like this instead: /random-file-name/wp-login.php.
Still though, the WPS Hide Login WordPress plugin can be useful for sites that already have WordPress installed at the root directory.
The creator of the plugin, Nicolas Kulka, has now fixed the issue and WPS Hide Login users should upgrade the plugin to version 1.9.1 to secure their sites from any potential attacks exploiting this vulnerability.
We’ve also rounded up the best WordPress plugins, best WordPress hosting and best web hosting services