Time-Based SQL Injection Vulnerability in Rename wp-login.php Plugin for WordPress

CVE-2026-93368

What is CVE-2026-93368?

The Rename wp-login.php to anything you want plugin for WordPress contains a time-based SQL Injection vulnerability that affects all versions up to 2.0.1. This flaw arises from insufficient escaping of user-provided parameters in SQL queries, allowing unauthenticated users to execute additional SQL commands. As a result, attackers could potentially extract sensitive information from the database due to the plugin’s failure to properly sanitize inputs, which leads to raw input being processed by the SQL handler.

References