CVE-2026-84168
Received Received - Intake

Authentication Bypass in Easy Hide Login WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: WPScan

Description
The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-23
Last Modified
2026-09-23
Generated
2026-09-23
AI Q&A
2026-09-23
EPSS Evaluated
N/A
NVD
CVE-2026-84168
EUVD
EUVD-2026-85037

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
easy_hide_login easy_hide_login to 1.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Easy Hide Login WordPress plugin before version 1.7 has a security flaw where its login page protection can be bypassed. An unauthenticated attacker can manipulate password-reset request parameters to access the standard WordPress login page. They can also retrieve the site's secret login slug from the response, exposing sensitive information.

Detection Guidance

Check if the Easy Hide Login plugin is installed and verify its version. If the version is below 1.7, the system is vulnerable. Inspect password-reset request parameters for unusual activity or attempts to access the standard login page.

Impact Analysis

This vulnerability allows attackers to bypass login security, potentially gaining unauthorized access to the WordPress admin panel. It also exposes the secret login slug, making it easier for attackers to target the site. This could lead to data breaches or site compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection. Organizations may face compliance penalties if this flaw results in data exposure or breaches.

Mitigation Strategies

Update the Easy Hide Login plugin to version 1.7 or later immediately. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84168. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart