CVE-2026-84168

MediumCVSS 5.3/10Last modified Sep 23, 2026

Description

The Easy Hide Login WordPress plugin before 1.7 does not fully enforce its hidden-login protection, allowing an unauthenticated attacker to reach the standard login page through certain password-reset request parameters and to recover the site's configured secret login slug from the returned page, defeating the Easy Hide Login WordPress plugin before 1.7's core protection.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Unknown	Easy Hide Login	< 1.7

References

https://wpscan.com/vulnerability/be4e40a1-8f2e-4c80-8615-77cc325c90b6/

Timeline

Published: Sep 23, 2026
Last modified: Sep 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-841695.3The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the o CVE-2026-84178.8Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/<pkgHandle>. Th CVE-2026-841708.3Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploa CVE-2026-841719.8The WP images upload on piclect WordPress plugin through 1.0 does not validate the name or type of uploaded files before writing them to a p CVE-2026-841726.3Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the cla CVE-2026-841738.3In Eclipse Ankaios versions v0.5.1 through v1.0.1, the agent-side Control Interface authorizer incorrectly evaluates multi-segment allow rul CVE-2026-841755.3In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use CVE-2026-841766.5Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Platform HTTP Vertx component. This issue affects Apach CVE-2026-841776.3Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apach CVE-2026-841786.1Cross-Site Request Forgery (CSRF) vulnerability in Apache Camel OAuth component. This issue affects Apache Camel: from 4.11.0 before 4.18 CVE-2026-841796.5Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result with CVE-2026-84184.3The Games Catalog plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.0. This is due to m