CVE-2026-110691

The WPOrLogin WordPress plugin, in versions prior to 3.1.0 , is vulnerable to an unauthenticated slug update. The plugin fails to perform a capability check or nonce validation when updating its hidden-login URL settings. This flaw allows an unauthenticated attacker to reassign the slugs for logi...

CVE-2026-110691 WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the logi...

PT-2023-25415 · WordPress · Change Wp Admin Login

Name of the Vulnerable Software and Affected Versions: Change WP Admin Login WordPress plugin versions prior to 1.1.4 Description: The issue allows an attacker to disclose the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. Recommendations: For version...