CVE-2025-58969: Custom Login URL Auth Bypass Vulnerability

CVE-2025-58969 Overview

CVE-2025-58969 is a Missing Authorization vulnerability [CWE-862] in the Greg Winiarski Custom Login URL WordPress plugin. The flaw affects all versions of custom-login-url up to and including 1.0.2. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality that should be restricted to authorized users.

The issue is network-exploitable without authentication or user interaction. Successful exploitation results in a limited integrity impact on the WordPress site, while confidentiality and availability remain unaffected.

Critical Impact
Unauthenticated attackers can bypass access controls in the Custom Login URL plugin, potentially modifying plugin state or configuration on affected WordPress sites.

Affected Products

Greg Winiarski Custom Login URL plugin for WordPress
Versions from n/a through 1.0.2 (inclusive)
WordPress installations with the custom-login-url plugin enabled

Discovery Timeline

2025-09-22 - CVE-2025-58969 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58969

Vulnerability Analysis

The vulnerability is a Broken Access Control weakness classified under [CWE-862] (Missing Authorization). The Custom Login URL plugin exposes functionality without validating whether the requesting user possesses the required capability or role. As a result, requests that should be limited to administrators or authenticated users are processed regardless of the caller's privilege level.

Because the attack vector is Network with low complexity and no privileges required, an attacker can send HTTP requests directly to the affected plugin endpoints. The integrity impact is limited to what the exposed functions permit modifying. The EPSS probability is currently 0.266% (18th percentile), indicating a low but non-zero likelihood of exploitation activity in the near term.

Root Cause

The plugin's action handlers omit capability checks such as current_user_can() and lack nonce verification via check_admin_referer() or wp_verify_nonce(). Without these guardrails, WordPress does not enforce the intended access control security level for the affected routes.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to the WordPress site targeting the plugin's exposed action or AJAX handler. Because authorization checks are missing, the plugin executes the requested action. Refer to the Patchstack Vulnerability Report for the technical breakdown of the affected endpoint.

Detection Methods for CVE-2025-58969

Indicators of Compromise

Unauthenticated POST requests to admin-ajax.php or admin-post.php referencing plugin actions associated with custom-login-url.
Unexpected changes to the WordPress login URL configuration or plugin option values.
HTTP requests from a single source hitting plugin endpoints without a valid authenticated session cookie.

Detection Strategies

Inspect web server access logs for requests to plugin endpoints that lack authentication cookies or _wpnonce parameters.
Audit the wp_options table for unexpected modifications to Custom Login URL settings.
Correlate WordPress plugin version inventory against the vulnerable range (<= 1.0.2) using site management tools.

Monitoring Recommendations

Enable WordPress activity logging to capture option changes and administrative action invocations.
Alert on bursts of requests to admin-ajax.php with actions tied to the Custom Login URL plugin from unauthenticated IPs.
Track version drift for the custom-login-url plugin across managed WordPress sites.

How to Mitigate CVE-2025-58969

Immediate Actions Required

Identify every WordPress site running the Custom Login URL plugin at version 1.0.2 or earlier.
Deactivate and remove the plugin if a patched version is not yet available from the vendor.
Restrict access to wp-admin, admin-ajax.php, and admin-post.php at the web application firewall level for known-bad request patterns.

Patch Information

No fixed version has been documented in the enriched CVE data. Consult the Patchstack Vulnerability Report for the latest remediation status and any released updates from the plugin author.

Workarounds

Uninstall the Custom Login URL plugin and adopt an actively maintained alternative for custom login URL functionality.
Add a WAF rule blocking unauthenticated requests to the plugin's action handlers.
Enforce IP allowlisting for /wp-admin/ paths to reduce the exposed attack surface.

bash

# Example: block unauthenticated access to the plugin's admin-ajax actions via nginx
location = /wp-admin/admin-ajax.php {
    if ($arg_action ~* "custom[_-]login[_-]url") {
        return 403;
    }
}