Easy Hide Login EUVD-2026-85037

The target must be running the Easy Hide Login WordPress plugin at a version before 1.7 with its hidden-login (custom secret slug) protection active - this is the plugin's core and default feature, so any site using the plugin for its intended purpose is exposed. Exploitation is remote and unauthenticated (AV:N/PR:N/UI:N) with no special configuration beyond having the plugin enabled; the attacker triggers the leak through specific password-reset request parameters. The primary limiting factor is impact, not access: the flaw only discloses the secret login-URL slug and defeats an obscurity layer - it does not itself bypass authentication, so follow-on value requires valid credentials or a separate login vulnerability.

This is a low-priority, defense-in-depth-defeating information disclosure rather than a direct compromise. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3 MEDIUM) is internally consistent: remotely reachable, no authentication, no user interaction, low-confidentiality-only impact. The single leaked asset is the site's secret login slug - the plugin's entire value proposition is hiding /wp-login.php behind a custom URL, and this bug lets an unauthenticated attacker recover that slug via crafted password-reset request parameters, restoring the very exposure the plugin was installed to prevent. Crucially, this only defeats an obscurity layer: recovering the slug does not grant access; an attacker still needs valid credentials or a separate authentication flaw to actually log in. No EPSS score, no CISA KEV listing, and no public exploit are present in the intelligence provided, so exploitation status is 'no public exploit identified at time of analysis.' The C:L rating is arguably generous given the disclosed data is a URL path rather than user PII or secrets. Real-world risk is modest - it lowers the bar for brute-force/credential-stuffing against the login page but is not independently actionable.

An unauthenticated attacker who knows a target runs Easy Hide Login sends a password-reset request with specific parameters that route them to the standard WordPress login page and echo back the configured secret login slug in the response. Having recovered the hidden slug, the attacker can now reach the login form directly to mount credential-stuffing or brute-force attacks that the plugin was meant to block. No public proof-of-concept is identified in the provided data, though the technique is straightforward given the description.