Sensitive Information Exposure in External Login Plugin for WordPress

CVE-2025-11196

What is CVE-2025-11196?

The External Login plugin for WordPress exposes sensitive information due to insufficient security checks in its 'exlog_test_connection' AJAX action. Authenticated users with subscriber-level access or higher can exploit this vulnerability to access critical data, including truncated usernames, email addresses, and password hashes. This flaw affects all plugin versions up to and including 1.11.2, putting user data at risk. Proper implementation of capability checks and nonce validation is essential to prevent unauthorized data exposure.

References