The MP Customize Login Page plugin for WordPress contains a broken Cross‑Site Request Forgery protection in the settings‑update handler. The nonce validation is inverted and the required action parameter is missing, turning the check into dead code that always allows the request to proceed. Additionally, the handler is hooked without any capability verification, letting any user craft a request that will be processed as if they had the privileges of the logged‑in administrator. An attacker can therefore change the appearance of the login page and its messages, potentially defacing the site or altering authentication cues.

This weakness affects the MP Customize Login Page plugin version 1.0 and earlier, installed on WordPress installations that do not upgrade beyond that release.

The CVSS score of 4.3 indicates moderate risk with limited impact compared to data exfiltration or code execution. EPSS is not available so exploitation frequency is unclear, and the vulnerability is not listed in CISA KEV. The likely attack vector is CSRF: an unauthenticated attacker convinces a logged‑in administrator to visit a crafted URL or submit a form, causing the administrator’s session to trigger a settings update. Because the attack requires only a convenient user interaction, an external threat actor could easily perform it once the plugin is installed on a site. The absence of a capability check means the attacker cannot gain any additional privileges beyond the changes to the login page.