EUVD-2026-38676
GHSA-4j34-5678-4gmg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Network-delivered CSRF with no attacker privileges; UI:R reflects mandatory admin interaction; I:L bounded to cosmetic settings; no confidentiality or availability impact possible.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.
AnalysisAI
Cross-Site Request Forgery in the MP Customize Login Page WordPress plugin (all versions ≤ 1.0) enables unauthenticated remote attackers to overwrite login page settings - background, logo URL, image dimensions, button colors, and login message - by tricking a logged-in administrator into submitting a crafted request. The root cause is a doubly defective nonce implementation in enter_mpclp_login_options(): the check is logically inverted (blocking valid nonces while passing invalid ones) and the required action parameter is omitted from wp_verify_nonce(), rendering the entire check dead code. Compounding this, the settings handler is registered on the init hook without any capability gate, so no privilege level is required from the attacker. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
The affected product is the MP Customize Login Page WordPress plugin by manuelpadillac, identified by CPE cpe:2.3:a:manuelpadillac:mp_customize_login_page:*:*:*:*:*:*:*:*. WordPress plugins use nonce tokens (generated and verified via wp_create_nonce()/wp_verify_nonce()) to bind form submissions to a specific user session and action, preventing CSRF. The vulnerability (CWE-352: Cross-Site Request Forgery) arises from two compounding defects in enter_mpclp_login_options() at class.mp-customize-login-page.php:L103: first, the nonce check logic is inverted - 'if (wp_verify_nonce(...)) { return false; }' - meaning a valid nonce causes an early exit while an invalid or absent nonce allows execution to continue; second, the action parameter is missing from the wp_verify_nonce() call, so the token is never correctly scoped to this specific operation. The function is also registered via the 'init' hook (L13) without a current_user_can() capability check, meaning the handler is reachable by any HTTP request, authenticated or not. This is a classic CSRF scenario where the server cannot distinguish a legitimate admin form submission from a forged one originating from an attacker-controlled page.
RemediationAI
No vendor-released patched version has been confirmed in the available data; the CPE version wildcard and absence of a fix version in references suggest the plugin remains unpatched. The primary recommended action is to deactivate and remove the MP Customize Login Page plugin until an update is available. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b9216875-8cb6-45a7-b23b-19d13f8b49dc?source=cve for a patched release. As a compensating control, a Web Application Firewall (WAF) rule blocking unexpected POST requests to the affected settings handler can reduce exposure, though this requires WAF capability and may interfere with legitimate plugin configuration. Plugin developers should correct the vulnerability by uninverting the nonce check logic in enter_mpclp_login_options(), supplying the required action parameter to wp_verify_nonce(), and adding a current_user_can('manage_options') capability check before processing any settings update.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today