Exploit for iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass

Name: Exploit for iThemes Security Free (< 7.9.1) & Pro (< 6.8.4) - Hide Backend Bypass
Rating: 5 (148 reviews)

2021-04-21 | CVSS -0.3

## https://sploitus.com/exploit?id=WPEX-ID:42FDB534-3AEF-4ED7-94A8-4CFE8FF977E1
A POST HTTP request with GET parameters bypassed the "Hide Backend" feature in vulnerable versions:

- The HTTP request method is POST
- The URL is pointing on wp-login.php
- The URL parameter is “action=postpass” (so it’s a GET one)
- The BODY parameter is “action=login” (so it’s a POST one)

According to the original researcher, "The plugin will read the GET and will let pass since it’s allowed, but WordPress will handle the POST one and will display the login form."