CVE-2026-6292: MP Customize Login Page Plugin CSRF Vulnerability in WordPress

Technical summary

The vulnerability stems from a fundamentally broken CSRF protection mechanism in the enter_mpclp_login_options() function. The nonce validation contains an inverted conditional (if wp_verify_nonce(...) { return false; }) that causes the function to reject legitimate requests and accept forged ones. Additionally, the nonce check lacks the required action parameter, causing wp_verify_nonce() to fail by design. The settings-update handler is hooked on the init action without capability checks, meaning any request—regardless of user role—will trigger the settings modification logic. This combination allows an attacker to craft a malicious request that, when submitted by a logged-in administrator through a social engineering attack, modifies arbitrary plugin configuration.

Business impact

Compromised login page appearance can damage user trust and brand perception. Attackers can redirect users to phishing pages by modifying the logo URL, inject misleading messages to social-engineer credentials, or deface the login interface to create confusion or frustration. While the CVSS score is MEDIUM (4.3) due to the requirement for user interaction and lack of data confidentiality/availability impact, the reputational and operational consequences can be significant, especially on public-facing WordPress sites where login page integrity is critical.

Affected systems

The MP Customize Login Page plugin for WordPress in all versions up to and including 1.0 is affected. This plugin is installed on WordPress sites where administrators use it to customize the appearance of the login page. Any WordPress deployment running this plugin is vulnerable if the site has logged-in administrative users.

Exploitability

Exploitation requires minimal technical skill. An attacker crafts an HTML form or JavaScript that submits a POST request to the plugin's settings endpoint with modified parameters. The request is sent to an administrator's browser, either through email, a malicious website, or compromised third-party content. Because the nonce check is inverted and incomplete, no valid token is needed. The attack succeeds if an administrator visits the attacker's page while logged into WordPress. No special network conditions, authentication, or authentication bypass are required.

Remediation

Immediately deactivate and remove the MP Customize Login Page plugin from all affected WordPress installations. The plugin should not be used until a patched version is released by the vendor. Site administrators should verify that no unauthorized changes to login page settings were made while the plugin was active. If the plugin must be replaced, use alternative login customization solutions from trusted vendors with demonstrated security practices.

Patch guidance

As of the vulnerability publication date, verify the vendor's official plugin repository or security advisory for a patched version. Updates should include proper nonce validation (removing the inverted check and adding the required action parameter) and capability checks on the settings handler. Apply patches immediately after confirming their authenticity through the official WordPress plugin directory or the vendor's website. Do not rely on automatic updates without first testing in a staging environment.

Detection guidance

Check for the presence of the MP Customize Login Page plugin in your WordPress plugins directory (/wp-content/plugins/). Audit WordPress administrative logs for unexpected changes to login page settings, including modifications to background images, logos, button colors, or login messages. Monitor HTTP POST requests to the plugin's settings endpoint for requests lacking valid nonces or originating from unexpected sources. Use WordPress security plugins that log administrative actions to track who made changes and when. Consider scanning for malicious referrer headers or embedded forms that might indicate CSRF attack attempts.

Why prioritize this

Although the CVSS score is MEDIUM (4.3), this vulnerability should be prioritized for immediate remediation because the plugin directly controls the WordPress login interface, a critical security boundary. Compromised login page appearance directly enables secondary attacks such as credential harvesting and phishing. The vulnerability is trivial to exploit (inverted nonce check + no capability validation) and requires only social engineering of an administrator. Any WordPress site using this plugin is at risk regardless of other security measures.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects: network-accessible exploitation (AV:N), low attack complexity (AC:L), no privileges required (PR:N), but requiring user interaction (UI:R). The impact is limited to integrity of login page settings (I:L), with no confidentiality or availability impact. However, this score understates the business risk because login page integrity directly enables credential theft and brand damage. Organizations should apply a higher internal risk rating if the plugin is in use.

Frequently asked questions