CVE-2026-1088: Login Page Editor WordPress Plugin CSRF Flaw

CVE-2026-1088 Overview

CVE-2026-1088 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Login Page Editor plugin for WordPress in all versions up to and including 1.2. The flaw resides in the devotion_loginform_process() AJAX action, which fails to validate a WordPress nonce before processing requests. Unauthenticated attackers can craft a malicious request that modifies the plugin's login page settings when a site administrator is tricked into clicking a crafted link. The vulnerability is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
Successful exploitation allows attackers to alter login page configuration on affected WordPress sites without authentication, potentially enabling further attacks against administrators and site visitors.

Affected Products

Login Page Editor plugin for WordPress (all versions through 1.2)
WordPress sites with the Login Page Editor plugin installed and active
Administrator-managed WordPress deployments where the vulnerable AJAX endpoint is reachable

Discovery Timeline

2026-01-24 - CVE-2026-1088 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1088

Vulnerability Analysis

The Login Page Editor plugin registers an AJAX action handled by the devotion_loginform_process() function within class/devotion.core.class.php. WordPress provides nonce tokens (wp_nonce_field, check_admin_referer, wp_verify_nonce) specifically to prevent CSRF attacks against state-changing operations. The plugin's handler omits any nonce validation step before persisting submitted values.

Because the AJAX endpoint accepts the action without verifying request authenticity, browsers belonging to authenticated administrators automatically include session cookies when triggered by an external page. Attackers leverage this trust to forge state-changing requests indirectly through victim administrators. The user interaction requirement limits exploitation to social engineering scenarios such as phishing links or attacker-controlled web pages.

Root Cause

The root cause is missing nonce validation on a privileged AJAX action. WordPress security guidance requires nonce checks for any handler that modifies persistent state. The devotion_loginform_process() function processes incoming POST data and updates plugin options without confirming the request originated from a legitimate administrative session. Source code review of the vulnerable handler is available in the WordPress Plugin Source Code repository.

Attack Vector

An attacker hosts a page containing an auto-submitting form or JavaScript fetch targeting the WordPress site's admin-ajax.php endpoint with the devotion_loginform_process action and attacker-chosen parameters. The attacker then lures a logged-in WordPress administrator into visiting the page through phishing email, malicious advertising, or comment links. The victim's browser submits the request with valid authentication cookies, and the plugin processes the forged input as if it came from the administrator. Additional technical context is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1088

Indicators of Compromise

Unexpected modifications to Login Page Editor plugin settings stored in the wp_options table
POST requests to /wp-admin/admin-ajax.php with action=devotion_loginform_process originating from external Referer headers
Administrator account activity correlated with visits to untrusted third-party pages
WordPress audit log entries showing plugin option changes without corresponding admin dashboard sessions

Detection Strategies

Monitor web server access logs for AJAX requests to devotion_loginform_process containing off-site or missing Referer values
Implement WordPress audit logging plugins to track changes to plugin options and identify unauthorized configuration drift
Inspect HTTP request bodies for parameters that match the plugin's expected fields but lack a corresponding nonce token

Monitoring Recommendations

Alert on any administrator session that triggers plugin settings changes immediately after navigating from an external referrer
Track plugin option value diffs over time and flag changes outside scheduled administrative windows
Correlate WordPress administrator browser activity with email gateway logs to identify phishing-driven CSRF attempts

How to Mitigate CVE-2026-1088

Immediate Actions Required

Deactivate the Login Page Editor plugin until a patched version is confirmed available from the vendor
Audit the current login page configuration values and restore known-good settings if unauthorized changes are detected
Instruct WordPress administrators to log out of admin sessions before browsing untrusted sites and to use a dedicated browser profile for administrative tasks

Patch Information

No vendor advisory listing a fixed version was available in the referenced sources at publication. Site operators should monitor the Wordfence Vulnerability Report and the WordPress plugin repository for an updated release that adds nonce validation to devotion_loginform_process(). Apply the update across all WordPress installations as soon as it is published.

Workarounds

Replace the Login Page Editor plugin with an actively maintained alternative that implements nonce validation on AJAX handlers
Deploy a Web Application Firewall (WAF) rule that blocks POST requests to admin-ajax.php?action=devotion_loginform_process lacking a valid same-origin Referer header
Restrict access to /wp-admin/ paths by source IP address using server-level controls where operationally feasible
Enforce SameSite=Lax or SameSite=Strict cookie attributes on WordPress authentication cookies to limit cross-site cookie transmission

bash

# Example nginx rule to block off-site requests to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        set $block 0;
        if ($args ~* "action=devotion_loginform_process") { set $block 1; }
        if ($http_referer !~* "^https?://yourdomain\.com/") { set $block "${block}1"; }
        if ($block = "11") { return 403; }
    }
}