CVE-2026-84168

MediumCVSS 5.3/10Last modified Sep 23, 2026

Description

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-841695.3The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the o CVE-2026-84178.8Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. Th CVE-2026-841719.8The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a p CVE-2026-841738.3In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rul CVE-2026-841755.3In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use CVE-2026-841766.5Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apach CVE-2026-841786.1Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18 CVE-2026-841796.5Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result with CVE-2026-84184.3The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to m CVE-2026-841805.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Knative component. This issue affects Apache Cam CVE-2026-841815.9Improper Authentication vulnerability in Apache Camel Shiro component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.CVE-2026-841855.9A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issu