{"id":"CVE-2026-110691","kind":"vulnerability","aliases":["CVE-2026-110691"],"related":[],"title":"WPOrLogin WordPress plugin lets anyone change login URL slugs","description":"The WPOrLogin  WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.","summary":"The WPOrLogin WordPress plugin before 3.1.0 skips capability and nonce checks when saving its hidden-login URL settings. An unauthenticated attacker can reassign the login, registration and password-recovery slugs and lock administrators out of the login page.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-plugin"],"not_affected_if":["plugin-not-installed","version-3.1.0-or-later"],"how_to_check":"- Check the installed WPOrLogin version in the WordPress admin plugin list or with `wp plugin get wp-orlogin --field=version` (unknown if the plugin slug differs)\n- Confirm whether the plugin is active on the site","fix":"- Update WPOrLogin to `3.1.0` or later\n- Review the login, registration and password-recovery slugs after updating and reset them if they were changed","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:40+00:00","updated_at":"2026-10-28T06:32:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T06:32:40Z","model":"claude-haiku-5-5","output":{"fix":"- Update WPOrLogin to `3.1.0` or later\n- Review the login, registration and password-recovery slugs after updating and reset them if they were changed","reach":"internet","title":"WPOrLogin WordPress plugin lets anyone change login URL slugs","impact":"medium","summary":"The WPOrLogin WordPress plugin before 3.1.0 skips capability and nonce checks when saving its hidden-login URL settings. An unauthenticated attacker can reassign the login, registration and password-recovery slugs and lock administrators out of the login page.","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker locks administrators out of the login page","analyst_note":"Confirm the plugin slug and the fixed-version details from the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed WPOrLogin version in the WordPress admin plugin list or with `wp plugin get wp-orlogin --field=version` (unknown if the plugin slug differs)\n- Confirm whether the plugin is active on the site","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-3.1.0-or-later"],"who_is_affected":"Sites running WPOrLogin before 3.1.0 with the plugin active are exposed, since the settings update path has no authorization check. Sites without the plugin, or running 3.1.0 or later, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000606,"input_tokens":3312,"output_tokens":550,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110691':12A,15A '-2026':11A,14A '3.1.0':26B,66C 'administr':55B,103C 'allow':87C 'anyon':5A 'attack':42B,89C 'capabl':28B,71C 'chang':6A 'check':31B,72C 'could':86C 'cve':10A,13A 'hidden':36B,81C 'hidden-login':35B,80C 'interfac':108C 'let':4A 'lock':54B,101C 'login':7A,37B,46B,59B,82C,93C,107C 'nonc':30B,76C 'packag':16B 'page':60B 'password':50B,97C 'password-recoveri':49B,96C 'perform':69C 'plugin':3A,20B,24B,64C 'reassign':44B,91C 'recoveri':51B,98C 'registr':47B,94C 'save':33B 'set':39B,84C 'skip':27B 'slug':9A,52B,99C 'unauthent':41B,88C 'updat':78C 'url':8A,38B,83C 'valid':74C 'wordpress':2A,17B,23B,63C 'wp':19B 'wp-plugin':18B 'wporlogin':1A,22B,62C","nicknames":[],"mitigations":[],"who_affected":"Sites running WPOrLogin before 3.1.0 with the plugin active are exposed, since the settings update path has no authorization check. Sites without the plugin, or running 3.1.0 or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110691","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110691","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}