CVE-2022-1732CWE-352

Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF

published July 11, 2022

CVSS
—
EPSS
1%
Percentile
45.4
In the wild
Unconfirmed
What it is

The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to make a logged in admin change them via a CSRF attack

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00553 · 45.4th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-07-11T12:56Z
EPSS history
Timeline
  • 11 JUL 12:56Z
    Rename wp-login.php <= 2.6.0 - Secret URL Update via CSRF
    cvelistv5