EUVD-2026-111714
GHSA-f65r-566x-cp6v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend unauthenticated request to settings handler
-
ExploitBypass absent capability and nonce checks
-
ExecutionReassign login/registration/recovery slugs
-
ImpactLock administrator out of login interface
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is that the WPOrLogin plugin at a version before 3.1.0 is installed and active on the target WordPress site; the settings-update routine for the hidden-login URL performs neither a capability check nor nonce validation, so exploitation works against default configurations with no authentication (PR:N) and no user interaction (UI:N). The practical limiting factors are narrow: the vulnerable plugin must be present and the fix (3.1.0) not yet applied, and the realized impact is operational lockout of the login/registration/recovery slugs rather than data disclosure or code execution. |
| Impact | Signals are consistent and point to a genuine but moderate-severity availability/integrity issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, base 6.5) describes a network-reachable, low-complexity, unauthenticated flaw with no confidentiality impact and only low integrity and availability impact - matching CWE-862 (missing authorization) where an attacker alters settings but does not gain code execution or data access. EPSS is low at 0.15% (4th percentile), the CVE is NOT on the CISA KEV list, and no confirmed working exploit code is cited (only vendor/NVD advisory references), so there is no evidence of active or widespread exploitation. The vendor priority label is 'this_month', aligning with a patch-promptly-but-not-emergency posture. No signals conflict: low EPSS, absence of KEV, and absence of confirmed PoC all agree with the medium CVSS. The main caveat is that the impact is operational denial - administrators being locked out of the login interface - which can be disruptive even though CVSS rates availability only as Low. |
| Exploit ScenarioDerived | An attacker sends a crafted unauthenticated HTTP request to the plugin's settings-update handler, which performs no capability check and validates no nonce, and reassigns the hidden login, registration, and password-recovery slugs to attacker-chosen values. Because the administrator no longer knows the new login URL, they are locked out of the WordPress admin interface, causing a denial-of-service condition. No public exploit identified at time of analysis; exploitation is network-based and low-complexity per the CVSS vector. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unauthenticated settings tampering in the WPOrLogin WordPress plugin before 3.1.0 lets remote attackers rewrite the plugin's hidden-login, registration and password-recovery slugs, which can lock administrators out of the WordPress login interface. The flaw is a missing-authorization issue (CWE-862): the settings-update routine performs neither a capability check nor nonce validation, so no credentials or user interaction are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, 6.5). Only sites running an affected plugin version are exposed; a vendor fix is available in 3.1.0, EPSS is low at 0.15% (4th percentile), and no public exploit code or CISA KEV entry was identified at time of analysis, so the realized impact is operational lockout rather than data disclosure or code execution.
RemediationAI
Vendor-released patch: update WPOrLogin to version 3.1.0, which adds the missing capability check and nonce validation to the hidden-login URL settings routine; the WPScan advisory at https://wpscan.com/vulnerability/1a5731c4-1bca-4136-bfa8-37e30e86c588/ is the authoritative reference and should be checked for any additional vendor guidance. Because the defect is only present in the plugin itself, sites that cannot apply 3.1.0 promptly can eliminate the exposure by deactivating and removing the plugin, at the cost of losing the custom login, registration and password-recovery slug functionality until a fixed version is reinstalled. The available sources do not document a narrower workaround such as endpoint filtering or configuration hardening, and priority is this_month rather than emergency: EPSS is 0.15% (4th percentile) with no public exploit code or CISA KEV entry identified at time of analysis, so scheduling the update in the current patch cycle is appropriate. Operators who discover that the login slug has already been altered will need administrative or database-level access to restore the affected settings before the administrator account can log in again, so maintaining an out-of-band recovery path (WP-CLI or direct database access) is prudent for affected sites.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WPOrLogin is a WordPress plugin that replaces the default wp-login.php, registration and password-recovery paths with configurable custom slugs stored in the plugin's own settings. The vulnerable code path is the routine that persists those hidden-login URL settings: per the advisory it neither calls a capability check (such as current_user_can for an administrative capability) nor validates a nonce (such as check_admin_referer / wp_verify_nonce) before applying the submitted values. CWE-862 (Missing Authorization) describes exactly this class of defect - a state-changing operation reachable without the authorization gate that the application's own design assumes. Because the WordPress nonce and capability checks are the only barriers that normally separate a privileged settings action from an anonymous HTTP request, their absence turns a routine configuration write into an unauthenticated action. The consequence is integrity and availability impact on the site's authentication entry points: the login, registration and password-recovery slugs can be reassigned to values the administrator does not know, effectively removing the administrator's route back into wp-admin. The trigger mechanics beyond the missing checks - the specific request endpoint and parameter names - are not described in the available sources.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Unauthenticated network request with no capability/nonce check gives AV:N/AC:L/PR:N/UI:N; attacker alters slugs (I:L) and locks out admins (A:L); no data exposure (C:N).
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB