WordPress users often rely on plugins to enhance their site’s security, like hiding the default admin login page. However, a significant security flaw has been found in the popular “Change WP Admin Login” plugin, which could expose your hidden login page. This vulnerability, identified as CVE-2023-3604, is rated as high severity and impacts versions prior to 1.1.4. It\u2019s crucial for website administrators and developers to understand this risk and take immediate action.<\/p>\n
This security issue affects the Change WP Admin Login WordPress plugin<\/strong>.<\/p>\n The vulnerability specifically impacts the Change WP Admin Login WordPress plugin versions earlier than 1.1.4<\/strong>. If you are using any version older than 1.1.4, your website is at risk.<\/p>\n The vulnerability is currently “Analyzed,” meaning its details have been investigated and confirmed. This information is now publicly available, making it even more important for users to apply the necessary fixes.<\/p>\n Rated as “High” severity, this information disclosure vulnerability should not be taken lightly. While it doesn\u2019t directly allow an attacker to log in, it defeats the primary purpose of the plugin: to hide your custom admin login URL. Knowing the login page URL makes it easier for attackers to launch brute-force attacks or other targeted attacks against your WordPress site’s administration area. This can lead to unauthorized access if weak passwords are in use.<\/p>\n The good news is that a fix is available! To protect your WordPress site from CVE-2023-3604, you must update the Change WP Admin Login plugin to version 1.1.4 or higher<\/strong>. This updated version addresses the flaw that was exposing the hidden login page URL.<\/p>\n Here\u2019s how to update your plugin:<\/p>\n If for some reason you cannot update immediately, consider temporarily deactivating the plugin until you can apply the patch. However, updating is the strongest recommendation.<\/p>\n https:\/\/wpscan.com\/vulnerability\/8f6615e8-f607-4ce4-a0e0-d5fc841ead16 WordPress users often rely on plugins to enhance their site’s security, like hiding the default admin login page. However, a significant security flaw has been found in the popular “Change WP Admin Login” plugin, which could expose your hidden login page. This vulnerability, identified as CVE-2023-3604, is rated as high severity and impacts versions prior […]<\/p>\n","protected":false},"author":17,"featured_media":2545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[932,697,755,726,736],"class_list":["post-3149","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-change-wp-admin-login","tag-information-disclosure","tag-plugin-security","tag-wordpress","tag-wordpress-plugin"],"blocksy_meta":[],"yoast_head":"\n\n
Affected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n
https:\/\/wpscan.com\/vulnerability\/8f6615e8-f607-4ce4-a0e0-d5fc841ead16<\/p>\n","protected":false},"excerpt":{"rendered":"