Security Risk in login page
-
Hello,
While testing Cluevo, I found a security risk in the standard login page. If a user clicks on the “Login” button without entering either a username or password, cluevo dumps you out to the underlying standard WordPress environment login page, which is NOT where you want users to go, especially if you use (as I do) a hidden login page as this action exposes that page to public access.
Is there a way to bypass Cluevo’s standard login page so that we can direct users to our own custom page with built-in redirect on acceptance / error?
Regards from Ireland
-
Hello ianmp,
we’ll have a setting to disable the cluevo login page in the next update, if we can fit it in we’ll let you define your own login page so we can just redirect you there.
Sorry, this took a bit longer than expected, but we’ve just released the 1.5.0 version of the plugin. This lets you enable/disable the cluevo login page. You can also select a WordPress page of your choice to act as the login page.
I’m closing this for now, feel free to pen another issue.
- The topic ‘Security Risk in login page’ is closed to new replies.
