Live › vulnerability › CVE-2026-110691
Go to dashboardThe WPOrLogin WordPress plugin before 3.1.0 skips capability and nonce checks when saving its hidden-login URL settings. An unauthenticated attacker can reassign the login, registration and password-recovery slugs and lock administrators out of the login page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running WPOrLogin before 3.1.0 with the plugin active are exposed, since the settings update path has no authorization check. Sites without the plugin, or running 3.1.0 or later, are not affected.
No product ranges from the sources yet.
wp plugin get wp-orlogin --field=version (unknown if the plugin slug differs)3.1.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.
This page as .md · .json · in your agent: get_signal("CVE-2026-110691")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.