The WP Custom Admin Login Page Logo plugin for WordPress allows unauthenticated attackers to modify the plugin’s settings because the wpclpl_save function lacks proper nonce validation. This flaw permits a forged request to alter configuration values such as logo image, login URL redirection, and other cosmetic settings. The impact is the ability to inject arbitrary settings that affect site appearance and potentially redirect users, but it does not provide direct code execution or access to admin credentials.

All installations of the WP Custom Admin Login Page Logo plugin running version 1.4.8.4 or earlier are affected. The plugin is distributed through the official WordPress plugin repository and is maintained by larsactionhero. Site administrators who have upgraded the plugin to a version newer than 1.4.8.4 are not impacted.

The vulnerability scores a CVSS 4.3, describing a moderate risk that requires user interaction but provides no direct privilege escalation. The EPSS score of less than 1% indicates a low probability that the flaw is actively exploited in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation typically involves tricking a logged‑in administrator into clicking a malicious link or submitting a forged form, after which the attacker can silently change plugin settings. Because the flaw requires an authenticated administrator to complete the request, the attacker’s success depends on the administrator’s interaction with a malicious payload.