Rename wp-login.php <= 2.6.0 - Cross-Site Request Forgery & Unauthenticated Settings Change
mediumThe Rename wp-login.php plugin for WordPress is vulnerable to Cross-Site Request Forgery as well as an authorization bypass vulnerability in versions up to, and including, 2.6.0. This allows unauthenticated attackers to update the site's login page directly or by tricking administrative users into performing an action...
- CVSS:
- 6.5
- Affected:
- up to 2.6.0
- Fix:
- No patched version reported
- Disclosed:
- Jun 16, 2022