One MAJOR Issue. Wp-login.php is exposed with wrong pass!

  • Hi Team!

    Love the plugin, but I have one major security issue that needs to be fixed: when a user enters in a wrong password, it re-directs them to the wp-login.php / wp-admin.php page.

    Is there a way to turn this off, or get rid of it completely please, and instead put a warning either as a popup or using some Ajax (just like how the registration form shows up etc.)

    I think this will be much MUCH more safer.

    Thanks for an awesome plugin

    https://www.ads-software.com/extend/plugins/nice-login-register-widget/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Author sgPlanwize

    (@sgplanwize)

    Hi praisehim, thank you for your feedback.

    To the best of our knowledge, there’s no security issue regarding entering wp-login.php. In fact, every time you enter wordpress administration by typing example.com/wp-admin you actually go to wp-login.php. Maybe you can be more specific regarding the security threat you’re afraid of.

    Either way, visually speaking, we are aware that it’s more elegant to have all interaction regarding the login process at the same page. Therefore, we are currently working on this feature and expect it to be included in the next version.

    SuperPlugin team

    Thread Starter praisehim

    (@praisehim)

    Hi Team!

    I was under the impression that exposing the wp-login.php to users was wrong 0.o I think I may have misunderstood. But you totally understood what I was saying, keeping all the error reporting/interaction on one page would be most aesthetically pleasing ?? For example, when the client enters a wrong credential, it redirects to the wp-login.php. It would be ideal to have the error displayed on the page where the login appears and so forth.

    I’m happy that it will be released in the next release. When would that be please?

    Thank you so much for replying back. I really like this plugin. It’s simple, easy AND IT DOES WHAT IT SAYS!!

    Plugin Author sgPlanwize

    (@sgplanwize)

    About 2-3 weeks.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘One MAJOR Issue. Wp-login.php is exposed with wrong pass!’ is closed to new replies.