CVE-2025-11196

Name of the Vulnerable Software and Affected Versions WordPress External Login plugin versions through 1.11.2

Description The External Login plugin for WordPress has a flaw that could expose sensitive information. The 'exlog test connection' AJAX action does not properly verify user permissions or require security checks, allowing authenticated attackers with subscriber-level access or higher to access the configured external database. This access can reveal truncated usernames, email addresses, and password hashes through the diagnostic test results view.

Recommendations Update the WordPress External Login plugin to a version newer than 1.11.2.