Admin and Site Enhancements (ASE) <= 9.1.2 - Unauthenticated Custom Login URL Disclosure and Login Protection Bypass
- ID
- WPSEC-2026-0292
- Plugin
- Admin and Site Enhancements (ASE) (admin-site-enhancements)
- Affected
- all versions before 9.1.3
- Remediation
- Update to 9.1.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Admin and Site Enhancements (ASE) on WPSec AttackSurface
- Fix released
- Published
Description
The Admin and Site Enhancements (ASE) plugin for WordPress is vulnerable to a protection mechanism bypass and information exposure in its Change Login URL feature in all versions up to, and including, 9.1.2. This is due to the login POST check treating the empty entry produced by an empty 'Allow login from' setting as a match for an empty Referer path segment (for example a Referer of the site's home URL), and to request paths beginning with a double slash, such as //wp-admin/, being parsed as a host so the redirect away from default login paths is skipped. This makes it possible for unauthenticated attackers to submit login attempts directly to wp-login.php and to learn the secret custom login URL from the plugin's failed-login redirect or from the wp-admin login redirect, defeating the hidden login URL the site owner configured.
References
- https://wpsec.com/vuln/WPSEC-2026-0292/
- https://plugins.svn.wordpress.org/admin-site-enhancements/tags/9.1.3/
- https://wordpress.org/plugins/admin-site-enhancements/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS