Unauthorized Access in WPOrLogin Plugin for WordPress
CVE-2026-110691
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-110691?
The WPOrLogin plugin for WordPress versions prior to 3.1.0 is vulnerable due to a lack of capability checks and nonce validation when modifying hidden-login URL settings. This vulnerability opens the door for unauthenticated attackers to arbitrarily change login, registration, and password-recovery slugs. If exploited, this may lock administrators out from accessing the login interface, significantly hindering site management and security.
Affected Version(s)
WPOrLogin 0 < 3.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.