The wps-hide-login plugin prior to 1.5.3 for WordPress has a protection bypass via wp-login.php in the Referer field.
wpserveur wps hide login