Sensitive Information Exposure in External Login Plugin for WordPress

CVE-2025-11196

What is CVE-2025-11196?

The External Login plugin for WordPress exposes sensitive information due to insufficient security checks in its 'exlog_test_connection' AJAX action. Authenticated users with subscriber-level access or higher can exploit this vulnerability to access critical data, including truncated usernames, email addresses, and password hashes. This flaw affects all plugin versions up to and including 1.11.2, putting user data at risk. Proper implementation of capability checks and nonce validation is essential to prevent unauthorized data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References