CVE-2025-46485 Overview
CVE-2025-46485 is a Missing Authorization vulnerability [CWE-862] in the Carlo La Pera WP Customize Login Page WordPress plugin. The flaw affects all versions up to and including 1.6.5. Attackers can access plugin functionality that is not properly constrained by Access Control Lists (ACLs).
The vulnerability is exploitable over the network without authentication or user interaction. It impacts the integrity of affected WordPress sites by allowing unauthorized modification of plugin settings. Confidentiality and availability are not directly impacted according to the published CVSS vector.
Critical Impact
Unauthenticated attackers can invoke plugin functions lacking authorization checks, enabling tampering with login page customization on WordPress sites running wp-customize-login-page version 1.6.5 or earlier.
Affected Products
- Carlo La Pera WP Customize Login Page plugin for WordPress
- All versions from n/a through 1.6.5
- WordPress sites with the wp-customize-login-page plugin installed and active
Discovery Timeline
- 2025-04-24 - CVE-2025-46485 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-46485
Vulnerability Analysis
The vulnerability stems from Broken Access Control in the wp-customize-login-page plugin. One or more plugin endpoints fail to validate the requester's role or capability before executing privileged actions. As a result, unauthenticated users can reach functionality intended only for administrators.
The issue is classified as [CWE-862] Missing Authorization. The attack requires no privileges and no user interaction. Exploitation occurs over the network against the WordPress site's HTTP interface.
The EPSS score is 0.298% with a percentile of 21.837, indicating a low observed likelihood of active exploitation at the time of analysis. However, WordPress plugins with broken access control are common targets for automated scanning campaigns.
Root Cause
The plugin exposes action handlers, likely registered via WordPress admin-ajax.php or REST routes, without invoking current_user_can() capability checks. Nonce verification alone, or the absence of any authorization gate, allows requests from unauthenticated sources to trigger administrative functions. See the Patchstack advisory for the vendor-tracked technical details.
Attack Vector
An attacker sends crafted HTTP requests directly to plugin-registered endpoints on the target WordPress site. Because authorization checks are missing, the server processes the request and applies changes reserved for privileged users. This can result in unauthorized modification of the login page appearance or related plugin settings, degrading site integrity.
No exploitation code example is available from verified public sources. Refer to the linked Patchstack advisory for further technical context.
Detection Methods for CVE-2025-46485
Indicators of Compromise
- Unexpected changes to WordPress login page branding, custom CSS, or plugin settings stored in the wp_options table
- HTTP POST requests to admin-ajax.php or plugin REST routes referencing wp-customize-login-page actions from unauthenticated sessions
- New or modified rows in wp_options with keys related to the wp-customize-login-page plugin without corresponding admin login events
Detection Strategies
- Inspect webserver access logs for anonymous requests targeting plugin endpoints under /wp-admin/admin-ajax.php with action parameters referencing the plugin slug
- Compare current plugin settings against a known-good baseline to identify unauthorized changes
- Correlate WordPress audit logs with administrator authentication events to detect setting changes lacking a corresponding admin session
Monitoring Recommendations
- Enable a WordPress activity logging plugin to capture option changes and plugin action invocations
- Alert on HTTP 200 responses to admin-ajax.php calls where the source IP has no prior authenticated session
- Monitor file integrity for the WordPress installation directory to detect follow-on tampering
How to Mitigate CVE-2025-46485
Immediate Actions Required
- Identify all WordPress sites running wp-customize-login-page version 1.6.5 or earlier and prioritize them for remediation
- Deactivate and remove the plugin if a patched release is not yet available or if the plugin is not essential
- Restrict access to /wp-admin/admin-ajax.php and REST API endpoints at the web application firewall (WAF) layer where feasible
Patch Information
At the time of the last NVD update on 2026-06-17, no fixed version was listed in the CVE record. Consult the Patchstack advisory for the latest vendor patch status and upgrade guidance.
Workarounds
- Deactivate the wp-customize-login-page plugin until a patched version is released
- Deploy WAF rules that block unauthenticated requests to plugin-specific admin-ajax.php actions
- Apply IP allow-listing on /wp-admin/ paths to limit exposure of administrative endpoints to trusted networks
# Example WAF rule concept (ModSecurity) to block unauthenticated plugin actions
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
"chain,deny,status:403,id:1004625,msg:'Block unauthenticated wp-customize-login-page action'"
SecRule ARGS:action "@rx wp[_-]customize[_-]login" \
"chain"
SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
