Cross-Site Request Forgery in LoginPress Custom Login Page Customizer for WordPress

CVE-2025-1764

Summary

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress has a vulnerability that allows unauthenticated attackers to manipulate site settings through Cross-Site Request Forgery (CSRF). Due to inadequate nonce validation in the 'custom_plugin_set_option' function, attackers can forge requests that trick site administrators into executing specific actions. This exploitation could lead to unauthorized privilege escalation by modifying user roles, such as elevating the default registration role to administrator. Therefore, if the 'WPBRIGADE_SDK__DEV_MODE' constant is set to 'true', the vulnerability could be exploited, posing a significant risk to site security and user integrity.

References