What is the CVSS score of EUVD-2026-38676?

EUVD-2026-38676 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

MP Customize Login Page EUVD-2026-38676

| CVE-2026-6292 MEDIUM

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-06-24 Wordfence

GHSA-4j34-5678-4gmg

WordPress CSRF Wordpress Plugin Mp Customize Login Page

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-delivered CSRF with no attacker privileges; UI:R reflects mandatory admin interaction; I:L bounded to cosmetic settings; no confidentiality or availability impact possible.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 07:03 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

MEDIUM 4.3

DescriptionCVE.org

The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.

AnalysisAI

Cross-Site Request Forgery in the MP Customize Login Page WordPress plugin (all versions ≤ 1.0) enables unauthenticated remote attackers to overwrite login page settings - background, logo URL, image dimensions, button colors, and login message - by tricking a logged-in administrator into submitting a crafted request. The root cause is a doubly defective nonce implementation in enter_mpclp_login_options(): the check is logically inverted (blocking valid nonces while passing invalid ones) and the required action parameter is omitted from wp_verify_nonce(), rendering the entire check dead code. Compounding this, the settings handler is registered on the init hook without any capability gate, so no privilege level is required from the attacker. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.

Technical ContextAI

The affected product is the MP Customize Login Page WordPress plugin by manuelpadillac, identified by CPE cpe:2.3:a:manuelpadillac:mp_customize_login_page:*:*:*:*:*:*:*:*. WordPress plugins use nonce tokens (generated and verified via wp_create_nonce()/wp_verify_nonce()) to bind form submissions to a specific user session and action, preventing CSRF. The vulnerability (CWE-352: Cross-Site Request Forgery) arises from two compounding defects in enter_mpclp_login_options() at class.mp-customize-login-page.php:L103: first, the nonce check logic is inverted - 'if (wp_verify_nonce(...)) { return false; }' - meaning a valid nonce causes an early exit while an invalid or absent nonce allows execution to continue; second, the action parameter is missing from the wp_verify_nonce() call, so the token is never correctly scoped to this specific operation. The function is also registered via the 'init' hook (L13) without a current_user_can() capability check, meaning the handler is reachable by any HTTP request, authenticated or not. This is a classic CSRF scenario where the server cannot distinguish a legitimate admin form submission from a forged one originating from an attacker-controlled page.

RemediationAI

No vendor-released patched version has been confirmed in the available data; the CPE version wildcard and absence of a fix version in references suggest the plugin remains unpatched. The primary recommended action is to deactivate and remove the MP Customize Login Page plugin until an update is available. Site administrators should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/b9216875-8cb6-45a7-b23b-19d13f8b49dc?source=cve for a patched release. As a compensating control, a Web Application Firewall (WAF) rule blocking unexpected POST requests to the affected settings handler can reduce exposure, though this requires WAF capability and may interfere with legitimate plugin configuration. Plugin developers should correct the vulnerability by uninverting the nonce check logic in enter_mpclp_login_options(), supplying the required action parameter to wp_verify_nonce(), and adding a current_user_can('manage_options') capability check before processing any settings update.