CVE-2026-110691

MediumCVSS 6.5/10Last modified Oct 28, 2026

Description

The WPOrLogin WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
Unknown	WPOrLogin	< 3.1.0

References

https://wpscan.com/vulnerability/1a5731c4-1bca-4136-bfa8-37e30e86c588/

Timeline

Published: Oct 28, 2026
Last modified: Oct 28, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1106924.1The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL b CVE-2026-1106946.3A vulnerability has been found in OAID Tengine up to 1.12.0. This vulnerability affects the function get_tm_file_model of the file source/se CVE-2026-1106956.3A vulnerability was detected in turboderp ExLlamaV2 up to 0.3.2. Affected is the function STFile.get_tensor of the file exllamav2/stloader.p CVE-2026-1106965.3A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected elem CVE-2026-1106979.9A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without CVE-2026-1106986.3A security vulnerability has been detected in Praat up to 7.0.02. Affected is the function whisper_model_load of the file external/whispercp CVE-2026-11079.8A weakness has been identified in EyouCMS up to 1.7.1/5.0. Impacted is the function check_userinfo of the file Diyajax.php of the component CVE-2026-110709.6Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who ha CVE-2026-1107017.2The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all CVE-2026-1107036.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc CVE-2026-1107055.3The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to CVE-2026-1107074.7The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Store