CVE-2026-93368: Rename wp-login.php to anything you want <= 2.0.1 - Unauthenticated SQL Injection via 'log' (Username) Parameter
The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wpunslash() to the 'log' POST value before dispatching the wploginfailed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can attempt exploitation. No account, privileges, or user interaction are required.
Which deployments are affected?
Installations using the Rename wp-login.php to anything you want WordPress plugin are affected in all versions through 2.0.1, inclusive. The vulnerable path is reached through the login username ('log') POST parameter.
What can an attacker obtain through exploitation?
An attacker may append SQL to an existing query and use time-based techniques to extract sensitive information from the WordPress database. The provided severity vector indicates confidentiality impact, with no stated integrity or availability impact.
Why does input escaping not prevent the attack?
WordPress core applies wp_unslash() to the log POST value before the wp_login_failed action is dispatched. This removes magic-quotes backslash escaping, allowing a raw single quote to reach the plugin handler.