CVE-2026-93368

Name of the Vulnerable Software and Affected Versions Rename wp-login.php to anything you want versions prior to 2.0.2

Description The plugin is subject to time-based SQL Injection, a technique where an attacker sends a query that forces the database to wait a specific amount of time before responding, allowing them to infer data. This occurs because of insufficient escaping of user-supplied parameters and a lack of preparation in the SQL query. Unauthenticated attackers can append additional SQL queries to extract sensitive information from the database. The issue is exacerbated because WordPress core applies the wp unslash() function to the log POST value before the wp login failed action is dispatched, which removes backslash escaping and allows raw single quotes to reach the plugin handler. The affected parameter is log (Username).

Recommendations Update to a version newer than 2.0.1. Avoid using the log parameter in the login process until the plugin is updated.