CVE-2026-1088: Login Page Editor WordPress CSRF Vulnerability

CVE-2026-1088 Overview

The Login Page Editor plugin for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 1.2. This security flaw stems from missing nonce validation on the devotion_loginform_process() AJAX action. The vulnerability enables unauthenticated attackers to modify the plugin's login page settings through a forged request, provided they can successfully trick a site administrator into performing an action such as clicking a malicious link.

Critical Impact

Unauthenticated attackers can modify WordPress login page settings via CSRF, potentially enabling phishing attacks, credential harvesting, or defacement of authentication interfaces.

Affected Products

• Login Page Editor plugin for WordPress versions ≤ 1.2
• WordPress installations utilizing the Login Page Editor plugin

Discovery Timeline

• 2026-01-24 - CVE-2026-1088 published to NVD
• 2026-01-26 - Last updated in NVD database

Technical Details for CVE-2026-1088

Vulnerability Analysis

This vulnerability is classified as CWE-352 (Cross-Site Request Forgery), which occurs when a web application fails to verify that a request was intentionally submitted by the authenticated user. In the Login Page Editor plugin, the devotion_loginform_process() AJAX action handler processes requests to modify login page settings without validating a security nonce token.

WordPress provides built-in CSRF protection through nonce (number used once) tokens that should be generated and verified for state-changing operations. The absence of this validation in the vulnerable function creates a direct attack vector for unauthorized modification of plugin settings.

Root Cause

The root cause of this vulnerability lies in the missing nonce validation within the devotion_loginform_process() function located in the devotion.core.class.php file. WordPress AJAX handlers should implement wp_verify_nonce() or check_ajax_referer() calls to validate that requests originate from legitimate authenticated sessions. The plugin developers failed to implement these security controls, leaving the settings modification endpoint unprotected against cross-origin forged requests.

Attack Vector

The attack requires social engineering to succeed. An attacker must craft a malicious webpage containing a hidden form or JavaScript code that automatically submits a request to the vulnerable AJAX endpoint. When an authenticated WordPress administrator visits the attacker's page, their browser sends the forged request with their valid session cookies, causing the plugin to accept and process the unauthorized settings change.

Attackers could leverage this to:

• Inject malicious scripts into the login page
• Redirect login form submissions to credential harvesting endpoints
• Deface the login interface to conduct phishing attacks
• Disable or modify login page customizations

The vulnerability does not require prior authentication, making any WordPress site with an administrator who can be socially engineered a potential target. For detailed technical analysis, refer to the Wordfence vulnerability report and the plugin source code review.

Detection Methods for CVE-2026-1088

Indicators of Compromise

• Unexpected changes to WordPress login page appearance or functionality
• Modified plugin settings in the Login Page Editor configuration without administrator action
• Suspicious HTTP POST requests to the WordPress AJAX handler targeting devotion_loginform_process action
• Administrator reports of clicking unknown links followed by login page modifications

Detection Strategies

• Monitor WordPress AJAX requests for the devotion_loginform_process action from unexpected referrers
• Implement Web Application Firewall (WAF) rules to detect and block CSRF attack patterns
• Review server access logs for POST requests to admin-ajax.php with suspicious Referer headers
• Deploy SentinelOne Singularity to detect and alert on anomalous web application behavior

Monitoring Recommendations

• Enable detailed logging for WordPress plugin configuration changes
• Set up alerts for modifications to Login Page Editor settings outside normal administrative workflows
• Monitor for login page content changes that may indicate successful exploitation
• Implement browser security headers including SameSite cookie attributes to reduce CSRF risk

How to Mitigate CVE-2026-1088

Immediate Actions Required

• Update the Login Page Editor plugin to a version newer than 1.2 that includes nonce validation
• If no patched version is available, deactivate and remove the Login Page Editor plugin
• Review current login page settings for unauthorized modifications
• Educate administrators about phishing risks and suspicious link awareness

Patch Information

The vulnerability affects Login Page Editor plugin versions up to and including 1.2. Site administrators should check the WordPress Plugin Directory for updated versions that address this CSRF vulnerability by implementing proper nonce validation.

Workarounds

• Temporarily deactivate the Login Page Editor plugin until a patched version is available
• Implement additional WAF rules to block forged requests to the vulnerable AJAX endpoint
• Configure browser security policies and Content Security Policy headers to limit cross-origin request capabilities
• Use security plugins that provide CSRF protection layers for WordPress AJAX handlers

# Verify current plugin version and disable if vulnerable
wp plugin list --name=login-page-editor --fields=name,version,status
wp plugin deactivate login-page-editor

# Check for unauthorized login page modifications
wp option get devotion_loginform_settings