CVE-2026-6292
Deferred Deferred - Pending Action

Cross-Site Request Forgery in MP Customize Login Page WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-07-14
AI Q&A
2026-06-24
EPSS Evaluated
2026-07-13
NVD
CVE-2026-6292
EUVD
EUVD-2026-38676

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mp_customize_login_page plugin to 1.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MP Customize Login Page plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.

This vulnerability exists because the nonce validation in the enter_mpclp_login_options() function is broken: it uses an inverted check and lacks the required action parameter for wp_verify_nonce().

As a result, the nonce check does not block malicious requests, allowing attackers to bypass CSRF protections.

Additionally, the settings-update handler is hooked on the init action without any capability check, enabling unauthenticated attackers to modify all plugin settings by tricking a logged-in administrator into submitting a crafted request.

Impact Analysis

This vulnerability allows unauthenticated attackers to modify the plugin's settings by exploiting a logged-in administrator's session.

  • Attackers can change the login page background.
  • Attackers can alter the logo URL.
  • Attackers can modify image dimensions.
  • Attackers can change button colors.
  • Attackers can modify the login message.

These changes could be used to mislead users, conduct phishing attacks, or degrade the trustworthiness of the login page.

Mitigation Strategies

To mitigate this vulnerability, you should update or remove the MP Customize Login Page plugin if it is installed and running a version up to and including 1.0, as these versions contain a broken nonce validation allowing CSRF attacks.

Additionally, restrict access to plugin settings by ensuring proper capability checks are in place and avoid tricking logged-in administrators into submitting crafted requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart