CVE-2024-6420: 
WordPress vulnerability analysis and mitigation

The Hide My WP Ghost WordPress plugin before version 5.2.02 contains a security vulnerability identified as CVE-2024-6420. The vulnerability allows unauthenticated visitors to access hidden login pages through redirects via the auth_redirect WordPress function. This vulnerability was discovered and disclosed on July 23, 2024 (WPScan).

The vulnerability exists in the plugin's handling of redirects to the login page. Specifically, the plugin fails to prevent redirects that occur through the auth_redirect WordPress function. The severity of this vulnerability has been assessed with a CVSS v3.1 base score of 8.6 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) (NVD).

When exploited, this vulnerability allows unauthorized users to discover and access the hidden login page of WordPress sites using the Hide My WP Ghost plugin. This effectively bypasses one of the main security features of the plugin, which is designed to hide the WordPress login page from potential attackers (WPScan).

The vulnerability can be exploited by unauthenticated visitors using specific URL parameters. For example, using GravityForms to redirect to the login page with a URL pattern like 'https://example.com/?gf_page=randomstring' (WPScan).

The vulnerability has been fixed in version 5.2.02 of the Hide My WP Ghost plugin. Site administrators are strongly advised to update to this version or later to protect their WordPress installations (WPScan).