The Rename wp-login.php plugin for WordPress is vulnerable to time‑based SQL injection in all versions through 2.0.1. The flaw arises from insufficient escaping on the user‑supplied 'log' (username) parameter and a lack of preparation on the SQL query that the plugin builds. Because WordPress core strips single‑quote escaping before the plugin processes the value, an unauthenticated attacker can inject arbitrary SQL. This allows the attacker to execute additional queries on the database, potentially retrieving sensitive information such as user credentials or configuration data. The weakness is classic SQL injection (CWE‑89).

The vulnerable plugin is 'Rename wp-login.php to anything you want', authored by travispluse. Versions up to and including 2.0.1 are affected. Users running WordPress sites that have this plugin installed and are using these versions are impacted. No other versions or products are listed as affected.

The CVSS score is 7.5, indicating a high severity. The EPSS score is below 1%, suggesting a low probability of exploitation at present. The vulnerability is listed in CISA KEV as not present. The injection can be triggered by sending a crafted POST request to the login endpoint with a specially crafted 'log' value; authentication is not required. The attacker can extract data via time delays or returned results. The lack of authentication and the direct web‑exposed parameter make exploitation likely if a site has the vulnerable plugin enabled.