Change Wp Admin Login Vulnerabilities

The All In One Login — WP Admin Login Page Security and Customization with Google reCAPTCHA, Social Login, Limit Login Attempt, 2FA, and more. plugin for WordPress is vulnerable to IP Address Spoofing in version 2.0.8 due to insufficient IP address validation and use of user-supplied HTTP headers as a primary method fo...

CVSS:

5.3

Affected:

2.0.8 – 2.0.8

Fixed in:

2.0.9

Disclosed:

Oct 9, 2025

CVE-2025-58595 on NVD →

The Change WP Admin Login plugin for WordPress is vulnerable to Protection Mechanism Failure in versions up to, and including, 1.1.3 via the 'filter_wp_login_php' function. This can allow unauthenticated attackers to find the URL of the login page even after it has been hidden by the plugin's functionality.

CVSS:

5.3

Affected:

up to 1.1.3

Fixed in:

1.1.4

Disclosed:

Jul 27, 2023

CVE-2023-3604 on NVD →

The Change WP Admin Login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, which could allow unauthenticated users to change the settings. The attacked could also be performed via a CSRF vector

CVSS:

5.4

Affected:

up to 1.0.9

Fixed in:

1.1.0

Disclosed:

May 9, 2022

CVE-2022-1589 on NVD →