The LoginPress | wp-login Custom Login Page Customizer plugin contains a flaw where the custom_plugin_set_option function does not correctly verify a nonce. As a result, anyone can send a forged HTTP request and update any WordPress option without authentication. If the site is running in developer mode—indicated by the WPBRIGADE_SDK__DEV_MODE constant set to true—an attacker can change the default role assigned to newly registered users to administrator and enable the registration feature. This allows the creation of a fully privileged administrator account solely through a click‑through CSRF attack, compromising the integrity of the site configuration and effectively providing remote administrative control.

The vulnerability affects versions of the hiddenpearls LoginPress plugin up to and including 3.3.1. These versions are WordPress plugins that customize the login page. Only installations where the WPBRIGADE_SDK__DEV_MODE constant is set to true can be exploited. No other products or versions are currently known to be affected.

The flaw carries a CVSS score of 7.5, indicating high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. An attacker must obtain a victim‑administrator’s interaction—typically by luring them to click a malicious link—to trigger the CSRF request. Successful exploitation results in the modification of critical WordPress settings and the creation of an attacker‑controlled administrator account, giving full control over the site.