The Login Page Editor plugin for WordPress is vulnerable to a cross‑site request forgery flaw that allows an unauthenticated attacker to alter the plugin’s login‑page settings through a forged AJAX request. The flaw stems from missing nonce validation on the delegation logic that processes updates to the login screen. Because the attacker can force an administrator to privilege the request, the impact is limited to configuration changes, not code execution or direct data exfiltration.

WordPress sites running the Login Page Editor plugin version 1.2 or earlier, deployed by the vendor zero1zerouk.

This issue carries a CVSS score of 4.3, indicating low‑medium severity, and an EPSS score of less than 1%, showing a very low predicted likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. Exploitation requires that an authenticated site administrator be tricked into visiting a crafted URL or executing a malicious link, enabling the attacker to send a forged request to the plugin’s AJAX endpoint. Because the plugin accepts the request without authentication, the attacker can modify settings such as the login form template or redirect URLs.