The WPS Hide Login plugin for WordPress, developed by tabrisrp, contains an authorization bypass vulnerability (CWE-863) that affects all versions up to and including 1.9.15.2. The flaw arises when the 'action=postpass' parameter is supplied, enabling attackers to discover the login page URL that the plugin is intended to hide. This vulnerability has a CVSS 3.1 base score of 5.3 (medium severity), reflecting its network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. No known exploits in the wild have been reported, and no patch or remediation details are currently available.

An attacker can bypass the login page hiding mechanism of the WPS Hide Login plugin, revealing the login page URL. This disclosure could facilitate targeted attacks against the login page, such as brute force attempts. However, the vulnerability does not directly impact integrity or availability, and the confidentiality impact is limited to login page disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider alternative methods to protect their login pages or monitor for updates from the plugin vendor. No vendor advisory or patch links are currently provided.