CVE-2026-110691: WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

Q: Which installations are affected?

WPOrLogin versions before 3.1.0 are affected. The issue concerns the plugin's hidden-login URL settings.

Q: Does exploitation require authentication or administrator access?

No. The vulnerable settings update lacks both a capability check and nonce validation, so an unauthenticated attacker could change the login, registration, and password-recovery slugs.

Q: What is the practical impact of a successful attack?

An attacker could reassign the relevant slugs and lock an administrator out of the normal login interface.

Published Oct 28, 2026

Updated

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.

Affected Software

1 affected component

WPOrLogin WPOrLogin<3.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WPOrLogin WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.1.0

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

WPOrLogin versions before 3.1.0 are affected. The issue concerns the plugin's hidden-login URL settings.

Does exploitation require authentication or administrator access?

No. The vulnerable settings update lacks both a capability check and nonce validation, so an unauthenticated attacker could change the login, registration, and password-recovery slugs.

What is the practical impact of a successful attack?

An attacker could reassign the relevant slugs and lock an administrator out of the normal login interface.

CVE-2026-110691: WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or administrator access?

What is the practical impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require authentication or administrator access?

What is the practical impact of a successful attack?