CVE-2025-11196 Overview
CVE-2025-11196 is an information disclosure vulnerability affecting the External Login plugin for WordPress in all versions up to and including 1.11.2. The flaw resides in the exlog_test_connection AJAX action, which lacks both capability checks and nonce validation. Authenticated attackers holding subscriber-level access or higher can abuse this diagnostic endpoint to query the configured external database. The response surfaces truncated usernames, email addresses, and password hashes through the diagnostic test results view. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Low-privileged WordPress users can extract credential material from the connected external authentication database, enabling offline hash cracking and account takeover attempts.
Affected Products
- External Login plugin for WordPress — all versions through 1.11.2
- WordPress sites configured with an external authentication database via this plugin
- Multi-site WordPress deployments relying on External Login for federated accounts
Discovery Timeline
- 2025-10-15 - CVE-2025-11196 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2025-11196
Vulnerability Analysis
The External Login plugin exposes a diagnostic AJAX endpoint intended for administrators to validate connectivity against an external user database. The handler registered for exlog_test_connection executes the configured database query and renders the results through the plugin's test results view. Because the handler does not verify the caller's capability and does not validate a WordPress nonce, any authenticated session, including a subscriber account, can invoke it.
The diagnostic path reads candidate records from the external database using the plugin's configured query logic in login/db.php. The response rendered through views/test_results.php includes truncated username strings, email addresses, and password hash values pulled directly from the external credential store. These fields are the exact material an attacker needs to perform offline password recovery or correlate accounts across systems.
Root Cause
The root cause is missing authorization and missing CSRF protection on an administrative diagnostic endpoint. The AJAX hook relies solely on the fact that WordPress authenticates the user, treating any logged-in request as trusted. There is no current_user_can() capability check and no check_ajax_referer() nonce validation around the handler defined in options/testing_ajax.php.
Attack Vector
Exploitation requires only a valid WordPress account at the subscriber tier, which is the default role granted by open registration on many sites. The attacker issues an authenticated POST request to wp-admin/admin-ajax.php with the action=exlog_test_connection parameter. The server returns the diagnostic view containing truncated credentials from the external database. Repeated invocation may allow enumeration of multiple records depending on how the plugin paginates or truncates results.
No verified exploit code is published. The vulnerability mechanism is documented in the Wordfence Vulnerability Report and in the plugin source references, including login/db.php and testing_ajax.php.
Detection Methods for CVE-2025-11196
Indicators of Compromise
- POST requests to /wp-admin/admin-ajax.php containing action=exlog_test_connection from non-administrator sessions.
- Unexpected read activity against the configured external authentication database originating from the WordPress host.
- Subscriber or contributor accounts accessing diagnostic plugin endpoints that are normally invoked only by administrators.
Detection Strategies
- Review web server access logs for admin-ajax.php requests referencing the exlog_test_connection action and correlate the source user with role assignments.
- Enable WordPress audit logging to capture AJAX actions invoked by non-administrative roles.
- Monitor the external database for SELECT queries that match the plugin's test connection pattern outside of administrator maintenance windows.
Monitoring Recommendations
- Alert on any new or recently registered subscriber account that issues AJAX requests to plugin-specific actions.
- Track outbound database queries from the WordPress application host and baseline normal diagnostic activity.
- Instrument failed authentication attempts against the external user store, which may follow successful hash extraction and offline cracking.
How to Mitigate CVE-2025-11196
Immediate Actions Required
- Update the External Login plugin to a version later than 1.11.2 as soon as a patched release is available from the maintainer.
- Disable or deactivate the External Login plugin on production sites until a fixed version is deployed.
- Restrict new user registration or set the default role to a non-interactive value to reduce the pool of accounts that can reach admin-ajax.php.
- Rotate credentials and force password resets for accounts stored in the external authentication database once exposure is suspected.
Patch Information
At the time of publication, the NVD entry does not list a fixed version. Administrators should consult the Wordfence advisory and the plugin's WordPress.org listing for the latest release notes. The upstream code paths requiring remediation are visible in login/db.php, options/testing_ajax.php, and views/test_results.php.
Workarounds
- Block requests to admin-ajax.php where the action parameter equals exlog_test_connection at the web application firewall (WAF) or reverse proxy layer.
- Remove the vulnerable AJAX hook registration in a mu-plugin that unregisters wp_ajax_exlog_test_connection for non-administrative users.
- Restrict access to /wp-admin/ paths by IP allowlist so only trusted operators can reach administrative AJAX endpoints.
- Audit the external database account used by the plugin and limit its SELECT scope to the minimum columns required for authentication.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.