CVE-2026-24578
BaseFortify
Publication date: 2026-01-23
Last updated on: 2026-04-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | admin_login_url_change | to 1.1.5 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-24578 is a Broken Access Control vulnerability in the WordPress plugin "Admin login URL Change" up to version 1.1.5. It occurs due to missing authorization, authentication, or nonce token checks in certain functions, which allows unprivileged users, such as subscribers, to perform actions that should be restricted to higher-privileged roles. [1]
How can this vulnerability impact me? :
This vulnerability can allow unprivileged users to perform administrative actions they should not have access to, potentially compromising the security of the WordPress site. However, the impact is considered low severity with a CVSS score of 4.3, and it is unlikely to be exploited. No official fix or patch is currently available. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the WordPress plugin "Admin login URL Change" version 1.1.5 or earlier is installed and active on your system. Since the issue involves missing authorization checks in the plugin's admin login URL change functionality, you can look for unusual access attempts or unauthorized actions performed by low-privileged users. Specific commands are not provided in the resources, but you can audit your web server logs for requests to the admin login URL change endpoints and verify user roles associated with those requests. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the affected plugin's admin login URL change functionality to trusted users only, monitoring for suspicious activity, and limiting user roles to prevent unprivileged users from exploiting the vulnerability. Since no official fix or patched version is currently available, consider disabling or removing the plugin until a patch is released. [1]