BaseFortify

Publication date: 2025-10-15

Last updated on: 2025-10-16

Assigner: Wordfence

Description

The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlog_test_connection' AJAX action lacking capability checks or nonce validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to query the configured external database and retrieve truncated usernames, email addresses, and password hashes via the diagnostic test results view.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-15

Last Modified

2025-10-16

Generated

2026-07-06

AI Q&A

2025-10-15

EPSS Evaluated

2026-07-05

NVD

CVE-2025-11196

EUVD

EUVD-2025-34542

Affected Vendors & Products

Vendor	Product	Version / Range
wordpress	external_login	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the External Login plugin for WordPress up to version 1.11.2. It occurs because the 'exlog_test_connection' AJAX action does not have proper capability checks or nonce validation. As a result, authenticated users with subscriber-level access or higher can exploit this to query the external database configured in the plugin and retrieve sensitive information such as truncated usernames, email addresses, and password hashes through the diagnostic test results view.

Impact Analysis

The vulnerability can lead to sensitive information exposure, allowing attackers with low-level authenticated access to obtain usernames, email addresses, and password hashes. This exposure can increase the risk of further attacks such as credential stuffing, phishing, or unauthorized access to user accounts, potentially compromising the security of the affected WordPress site and its users.

Hi! I’m here to help you understand CVE-2025-11196. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70