CVE-2026-6292

Name of the Vulnerable Software and Affected Versions MP Customize Login Page versions prior to 1.1

Description The MP Customize Login Page plugin for WordPress is subject to Cross-Site Request Forgery (CSRF), a flaw where an attacker tricks a logged-in user into performing unwanted actions. The issue resides in the enter mpclp login options() function, which contains an inverted nonce validation check and lacks the required action parameter, rendering the security check ineffective. Additionally, the settings-update handler is hooked on init without capability checks. This allows unauthenticated attackers to modify plugin settings, such as the login page background, logo URL, image dimensions, button colors, and login message, by inducing an administrator to submit a crafted request.

Recommendations Update to a version later than 1.0. As a temporary workaround, restrict access to the plugin settings or disable the enter mpclp login options() function until a patch is applied.