Rename wp-login.php EUVD-2026-85169

No special conditions - remote unauthenticated exploitation against default configurations of the 'Rename wp-login.php to anything you want' WordPress plugin (versions ≤2.0.1). The only prerequisite is that the vulnerable plugin is installed and active so that its wp_login_failed handler processes the 'log' POST parameter; exploitation reaches the sink specifically because WordPress core applies wp_unslash() to 'log' before dispatching wp_login_failed, removing magic-quotes escaping. Limiting factors: the injection is time-based blind (slower, timing-dependent extraction rather than direct data return), and impact is confined to database reads (C:H; no write or availability impact). No authentication, user interaction, or non-default setting is required.

This is a genuine, actionable priority rather than an inflated high-CVSS artifact. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N describes remote, unauthenticated, low-complexity exploitation with high confidentiality impact and no integrity/availability impact - fully consistent with a blind SQL injection that reads (but does not modify) database contents. The description reinforces this: the 'log' (username) POST parameter reaches the plugin's SQL query without sufficient escaping or prepared-statement use, and WordPress core's wp_unslash() on the value strips magic-quotes escaping so a raw single quote reaches the vulnerable handler - a concrete, credible exploitation path on default installs. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active exploitation; per the precision rules this is 'no public exploit identified at time of analysis.' The main tempering factor is not exploitability but reach: this depends entirely on how widely this specific plugin is deployed. Being time-based blind SQLi, data extraction is slower and noisier than in-band injection, but it remains fully unauthenticated. Net: treat as a real patch-now issue for anyone running this plugin, while recognizing the absence of exploitation telemetry (no EPSS/KEV/POC) means it is not yet demonstrably mass-exploited.

An unauthenticated attacker sends a crafted POST request to the WordPress login endpoint with a malicious 'log' (username) value containing SQL and a time-delay payload (e.g., a conditional SLEEP). Because WordPress core wp_unslash() strips the escaping before the wp_login_failed action reaches the plugin, the single quote breaks out of the query, letting the attacker infer database contents bit-by-bit from response timing and gradually extract sensitive data such as user credentials. No public exploit code is identified in the provided data, though Wordfence has documented the flaw.