Hacker News new | ask | show | jobs
by rograndom 2596 days ago
Do not use that plugin. It has a unintentional back door where you can just bypass it completely and get the login screen. All of the forked plugins that are based on it, that I have seen, have the same issue.

Plus, since it's more than 3 versions old, many of the security plugins will flag it. If it's your site, that's fine. If you have set a site up for someone else, it's hard to explain that it's ok to use this plugin.

1 comments

Can you give me more detail than "unintentional back door"? I'm obviously interested, but it's difficult to know what to do without more of a pointer on what the issue is.

Edit: Found this - https://github.com/ellatrix/rename-wp-login/issues/27 - and can reproduce that behaviour, so I'm going to start looking for something new, or potentially taking over that plugin.

Edit 2: This seems to be a maintained fork that is in active development and covers the issues on the original abandoned GitHub repo - https://wordpress.org/plugins/wps-hide-login/