Rename Wp Login Php To Anything You Want
Monthly
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Unauthenticated time-based blind SQL injection in the WordPress plugin 'Rename wp-login.php to anything you want' (all versions up to and including 2.0.1) allows remote attackers to inject arbitrary SQL through the 'log' username parameter processed by the plugin's wp_login_failed handler, enabling extraction of sensitive data from the underlying WordPress database. The flaw is rated CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and requires no authentication, user interaction, or non-default configuration - only that the vulnerable plugin is installed and active. Impact is confined to database reads with no write or availability effect, and exploitation is time-based blind, meaning extraction is timing-dependent and slower than direct-return injection; no public exploit code was identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).