The HC Custom WP-Admin URL WordPress plugin up to and including 1.4 leaks the secret login URL when sending a specific crafted request
hc custom wp-admin url project hc custom wp-admin url