The vulnerability in the Change WP URL plugin arises because the "change-wp-url" settings page fails to validate nonce tokens. This flaw allows an unauthenticated attacker to craft a forged request that, if an administrator clicks, will alter the site’s login URL. The result is an uncontrolled change to the core authentication endpoint, which could enable credential harvesting, impersonation attacks, or lock administrators out if the new URL is unknown or incorrect. The weakness is documented as CWE‑352.

All WordPress sites that have installed the Change WP URL plugin by chrisnowak in versions 1.0 or earlier are vulnerable. No other product or vendor is affected according to the CNA data.

The CVSS score is 4.3, placing the flaw in the low severity range. The EPSS score of less than 1 % indicates a very low likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker gain the ability to send a crafted link to an administrator, typically through phishing or social engineering. Because the flaw is limited to a plugin setting page and does not involve direct code execution, the overall risk remains modest but still warrants remediation to prevent accidental administrative lock‑outs or credential compromise.