CVE-2026-1398: Change WP URL Plugin CSRF Vulnerability

CVE-2026-1398 Overview

The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.0. This vulnerability exists due to missing or incorrect nonce validation on the 'change-wp-url' page. Exploitation allows unauthenticated attackers to change the WordPress Login URL via a forged request, provided they can trick a site administrator into performing an action such as clicking on a malicious link.

Critical Impact

Unauthenticated attackers can modify the WordPress login URL through social engineering, potentially locking legitimate administrators out of the WordPress dashboard or redirecting login attempts to malicious endpoints.

Affected Products

• Change WP URL plugin for WordPress version 1.0 and earlier
• WordPress installations with vulnerable Change WP URL plugin versions

Discovery Timeline

• 2026-01-28 - CVE-2026-1398 published to NVD
• 2026-01-29 - Last updated in NVD database

Technical Details for CVE-2026-1398

Vulnerability Analysis

This Cross-Site Request Forgery (CSRF) vulnerability affects the Change WP URL WordPress plugin's administrative functionality. The plugin fails to properly validate request authenticity when processing changes to the WordPress login URL. Without proper nonce verification, the plugin cannot distinguish between legitimate administrative requests and forged requests initiated by an attacker.

The vulnerability is classified under CWE-352 (Cross-Site Request Forgery), which occurs when a web application does not sufficiently verify that a request was intentionally provided by the user who submitted it. In this case, the change-wp-url page processes URL modification requests without confirming the request originated from an authorized session.

Root Cause

The root cause of this vulnerability is missing or incorrect nonce validation in the plugin's request handling logic. WordPress provides nonce (number used once) functionality to protect forms and URLs from CSRF attacks. The vulnerable code at line 18 and line 85 of change-wp-url.php fails to implement proper wp_verify_nonce() or check_admin_referer() checks before processing sensitive URL change operations.

Attack Vector

The attack is conducted over the network and requires user interaction. An attacker must craft a malicious webpage or link containing a forged request to the vulnerable plugin endpoint. When an authenticated WordPress administrator visits the attacker's page or clicks the malicious link, the forged request executes with the administrator's session credentials, modifying the WordPress login URL without the administrator's knowledge or consent.

The attack flow typically involves:

1. Attacker identifies a WordPress site using the vulnerable Change WP URL plugin
2. Attacker crafts a malicious HTML page containing a hidden form or JavaScript that submits a request to change the login URL
3. Attacker distributes the link via phishing email, social media, or compromised websites
4. An authenticated administrator clicks the link while logged into their WordPress site
5. The browser automatically submits the forged request with the administrator's session cookies
6. The plugin processes the request and changes the login URL

Detection Methods for CVE-2026-1398

Indicators of Compromise

• Unexpected changes to WordPress login URL settings without administrator action
• Web server logs showing requests to the change-wp-url settings page from external referrers
• Users or administrators unable to access the standard wp-login.php login page
• Suspicious entries in WordPress options table related to login URL configuration

Detection Strategies

• Monitor WordPress database for unexpected modifications to login URL options
• Review web server access logs for unusual POST requests to the plugin's settings page
• Implement Content Security Policy (CSP) headers to detect unauthorized form submissions
• Deploy web application firewalls (WAF) with CSRF detection capabilities

Monitoring Recommendations

• Enable and regularly review WordPress audit logging for settings changes
• Configure alerts for administrative setting modifications outside normal business hours
• Monitor for phishing campaigns targeting WordPress administrators in your organization
• Implement browser-based CSRF protection plugins as an additional defense layer

How to Mitigate CVE-2026-1398

Immediate Actions Required

• Deactivate and remove the Change WP URL plugin if version 1.0 or earlier is installed
• Verify current WordPress login URL settings have not been tampered with
• Review recent administrative actions in WordPress audit logs for suspicious activity
• Educate administrators about phishing risks and CSRF attack vectors

Patch Information

At the time of this advisory, administrators should check the WordPress Plugin Trunk for updated versions that include proper nonce validation. Review the Wordfence Vulnerability Report for the latest remediation guidance and version updates.

Workarounds

• Remove the Change WP URL plugin until a patched version is available
• Use alternative WordPress login URL plugins that implement proper CSRF protection
• Implement a web application firewall (WAF) rule to block unauthorized requests to the plugin's settings page
• Restrict administrative access to trusted IP addresses where feasible

# WordPress CLI command to check installed plugin version
wp plugin list --name=change-wp-url --fields=name,version,status

# Deactivate the vulnerable plugin
wp plugin deactivate change-wp-url

# Verify current site URL settings
wp option get siteurl
wp option get home