A missing authorization flaw in the Admin login URL Change plugin allows an attacker to bypass standard access controls, enabling operations that should be restricted to privileged users. The vulnerability stems from incorrectly configured access control security levels, meaning ordinary users, or potentially unauthenticated actors, can exploit the plugin’s functionality to gain elevated privileges or manipulate login URLs. This broken access control flaw (CWE‑862) directly threatens the confidentiality, integrity, and availability of the site’s administrative functions.

WordPress sites that have installed Jahid Hasan’s Admin login URL Change plugin, versions up through 1.1.5. The flaw affects the entire plugin codebase and any WordPress installation that has not upgraded beyond the affected version.

The CVSS base score of 4.3 places this issue in the moderate severity range, and the EPSS score of less than 1 % indicates a low probability of being actively exploited in the wild. The vulnerability is not listed in CISA’s known‑exploited catalog. The likely attack vector is through the web interface of the plugin, where an attacker can send crafted requests to APIs or endpoints without verifying user roles. The lack of authentication checks enables successful exploitation, yielding unauthorized administrative access on affected sites.