Mp Customize Login Page Vulnerabilities

The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and i...

CVSS:

4.3

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Jun 23, 2026

CVE-2026-6292 on NVD →