CVE-2026-1088

Name of the Vulnerable Software and Affected Versions Login Page Editor plugin for WordPress versions prior to 1.3

Description The Login Page Editor plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is a result of a lack of nonce validation on the devotion loginform process() AJAX action. An unauthenticated attacker could potentially modify the plugin’s login page settings by deceiving a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Login Page Editor plugin to version 1.3 or later.