CVE-2026-6292
Received Received - Intake
Cross-Site Request Forgery in MP Customize Login Page WordPress Plugin

Publication date: 2026-06-24

Last updated on: 2026-06-24

Assigner: Wordfence

Description
The MP Customize Login Page plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This is due to a completely broken nonce validation in the enter_mpclp_login_options() function, which contains an inverted check (if wp_verify_nonce(...) { return false; }) and is missing the required action parameter for wp_verify_nonce(). As a result, the nonce check is effectively dead code: it never blocks malicious requests because a CSRF-supplied empty/invalid nonce always returns false, satisfying the inverted condition to continue execution. Furthermore, the settings-update handler is hooked on init without any capability check. This makes it possible for unauthenticated attackers to modify all plugin setting, including login page background, logo URL, image dimensions, button colors, and login message, by tricking a logged-in administrator into submitting a crafted request.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-24
Last Modified
2026-06-24
Generated
2026-06-24
AI Q&A
2026-06-24
EPSS Evaluated
N/A
NVD
CVE-2026-6292
EUVD
EUVD-2026-38676
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mp_customize_login_page plugin to 1.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The MP Customize Login Page plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.0.

This vulnerability exists because the nonce validation in the enter_mpclp_login_options() function is broken: it uses an inverted check and lacks the required action parameter for wp_verify_nonce().

As a result, the nonce check does not block malicious requests, allowing attackers to bypass CSRF protections.

Additionally, the settings-update handler is hooked on the init action without any capability check, enabling unauthenticated attackers to modify all plugin settings by tricking a logged-in administrator into submitting a crafted request.

Impact Analysis

This vulnerability allows unauthenticated attackers to modify the plugin's settings by exploiting a logged-in administrator's session.

  • Attackers can change the login page background.
  • Attackers can alter the logo URL.
  • Attackers can modify image dimensions.
  • Attackers can change button colors.
  • Attackers can modify the login message.

These changes could be used to mislead users, conduct phishing attacks, or degrade the trustworthiness of the login page.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-6292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart