Cross-Site Request Forgery in MP Customize Login Page Plugin for WordPress

CVE-2026-6292

What is CVE-2026-6292?

The MP Customize Login Page plugin for WordPress contains a serious Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0. The flaw originates from a faulty nonce validation process in the enter_mpclp_login_options() function, which incorrectly applies an inverted check that always permits execution regardless of the nonce condition. This opens the door for unauthenticated attackers to manipulate plugin settings, which could include alterations to the login page's background, logo URL, image dimensions, button colors, and login message. Importantly, these malicious actions can be executed by tricking a logged-in administrator, posing a significant risk to site security.

References