Security Alert Summary
The Rename wp-login.php to anything you want plugin for WordPress contains a time-based SQL injection vulnerability in the username parameter. An unauthenticated attacker can supply crafted input to the log POST value that reaches the plugin without sufficient escaping or prepared statements, allowing additional SQL to be appended to existing queries and enabling extraction of sensitive data from the database.
CVE Details
- CVE ID: CVE-2026-93368
- Affected component: Rename wp-login.php to anything you want plugin (vendor: travispluse)
- Affected versions: All versions up to and including 2.0.1
- Published: September 23, 2026 at 9:17 AM
- Last modified: September 23, 2026 at 2:57 PM
- CVSS v3.1: Base Score 7.5 (HIGH) – CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Authentication / Privileges / User Interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: HIGH; Integrity: NONE; Availability: NONE
- Weakness (CWE): CWE-89 (SQL Injection)
Technical Details
This vulnerability is a time-based SQL injection via the log (Username) POST parameter. The plugin fails to sufficiently escape or parameterize user-supplied input before including it in an SQL query, and does not apply appropriate preparation for the existing SQL statements. As a result, unauthenticated attackers can append additional SQL queries to the plugin’s queries and use time-based techniques to extract sensitive information from the database.
The issue is exacerbated by WordPress core behavior: core applies wp_unslash() to the log POST value before dispatching the wp_login_failed action, which removes backslash escaping that might otherwise mitigate raw single quotes. That raw single quote can reach the plugin’s handler, which lacks sufficient escaping and parameterization on the SQL it constructs.
The impact is limited to data exposure through SQL query results (confidentiality loss) rather than direct integrity or availability effects, according to the provided CVSS details.
How This Could Impact Your Website
On a site using this plugin, an external attacker with no account could target the login flow to probe the database. In a typical small business scenario, this could expose internal user data that includes email addresses or other sensitive fields tied to user records. For example, an attacker might use time-based SQL techniques to enumerate or confirm email addresses for staff accounts, increasing the risk of targeted phishing against the site owner, editors, or external contractors who contribute content.
This vulnerability does not, on its own, indicate automatic site takeover, but it does raise the likelihood of information disclosure that can be leveraged in social engineering attacks. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor or low-privilege accounts that still hold email addresses.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior around authentication and login failures.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L217
- https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L388
- https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L398
- https://plugins.trac.wordpress.org/browser/rename-wp-loginphp-to-anything-you-want/tags/2.0.1/init.php#L421
- https://www.wordfence.com/threat-intel/vulnerabilities/id/89a07c47-b57c-49de-9f7c-a2bb29e3fecc?source=cve
