CVE-2026-1503: WordPress login_register CSRF Vulnerability

CVE-2026-1503 Overview

The login_register plugin for WordPress is vulnerable to a chained Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability in all versions up to, and including, 1.2.0. This vulnerability exists due to missing nonce validation on the settings page combined with insufficient input sanitization and output escaping on the login_register_login_post parameter. Unauthenticated attackers can exploit this flaw to inject arbitrary web scripts into pages that execute whenever a user accesses an injected page, provided they can trick an administrator into clicking a malicious link.

Critical Impact

Attackers can inject persistent malicious scripts into WordPress pages by exploiting missing CSRF protection, potentially leading to administrator account compromise, website defacement, or malicious redirect chains affecting all site visitors.

Affected Products

• WordPress login_register plugin versions up to and including 1.2.0
• WordPress installations using the affected plugin versions

Discovery Timeline

• 2026-03-21 - CVE-2026-1503 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-1503

Vulnerability Analysis

This vulnerability represents a two-stage attack chain combining CSRF with Stored XSS. The login_register plugin fails to implement proper nonce validation on its settings page, which means the application does not verify that form submissions originate from legitimate authenticated sessions. This missing CSRF protection allows attackers to craft malicious requests that administrators can unknowingly execute.

The second component of this vulnerability involves improper handling of user input in the login_register_login_post parameter. The plugin does not adequately sanitize input data before storing it and fails to properly escape output when rendering this data on pages. This allows JavaScript code to be persisted in the database and executed in the browser context of any user viewing the affected page.

Root Cause

The root cause is twofold: First, the absence of WordPress nonce verification functions (wp_verify_nonce() or check_admin_referer()) in the settings page handler allows unauthorized form submissions. Second, the plugin fails to use WordPress sanitization functions like sanitize_text_field() on input and escaping functions like esc_html() or esc_attr() on output for the login_register_login_post parameter. The vulnerable code can be examined in the login_register_admin.php file.

Attack Vector

The attack requires social engineering to succeed. An attacker would craft a malicious HTML page containing an auto-submitting form that targets the plugin's settings endpoint with a payload containing JavaScript in the login_register_login_post parameter. When an authenticated WordPress administrator visits the attacker's page or clicks a malicious link, the forged request is submitted using the administrator's session. The malicious script is then stored in the WordPress database and executes whenever any user views a page where the affected setting value is rendered.

The vulnerability can be exploited by crafting a forged request that submits malicious JavaScript code to the plugin's settings endpoint. Since no nonce validation occurs, the request is processed if the victim has an active administrator session. The injected script persists and executes in the context of future visitors' browsers.

Detection Methods for CVE-2026-1503

Indicators of Compromise

• Unexpected JavaScript code in the login_register_login_post option value in the WordPress wp_options table
• Suspicious outbound connections or redirect behavior on login/registration pages
• Unusual administrator activity logs showing settings changes without corresponding legitimate actions
• Browser developer tools showing unexpected script execution on login or registration related pages

Detection Strategies

• Review WordPress database for malicious content in plugin option values using SELECT * FROM wp_options WHERE option_name LIKE '%login_register%'
• Monitor web server access logs for suspicious POST requests to the plugin settings endpoint from external referrers
• Implement Web Application Firewall (WAF) rules to detect and block common XSS payloads in form submissions
• Use WordPress security plugins to scan for known malicious code patterns in stored settings

Monitoring Recommendations

• Enable comprehensive logging for WordPress administrative actions, particularly settings changes
• Configure alerts for changes to the login_register plugin settings outside of normal administrative workflows
• Monitor for unusual JavaScript execution patterns or unexpected external resource loading on WordPress pages
• Regularly audit plugin settings values for suspicious content or encoded payloads

How to Mitigate CVE-2026-1503

Immediate Actions Required

• Update the login_register plugin to a patched version when available from the WordPress plugin repository
• Review current plugin settings for any signs of injected malicious content
• Consider temporarily deactivating the login_register plugin until a patch is released
• Implement a Web Application Firewall with CSRF and XSS protection rules
• Educate administrators about phishing risks and avoiding clicking untrusted links while logged into WordPress

Patch Information

A security patch addressing this vulnerability should be obtained from the official WordPress plugin repository. Site administrators should monitor the Wordfence Vulnerability Report for updates on patch availability. Until a patch is available, implementing the workarounds below is strongly recommended.

Workarounds

• Deactivate the login_register plugin if not critical to site functionality
• Restrict access to the WordPress admin panel by IP address using .htaccess or server configuration
• Implement additional CSRF protection at the server or WAF level for all WordPress admin endpoints
• Use browser extensions or security policies to prevent administrators from inadvertently executing CSRF attacks while logged in

# Apache .htaccess example to restrict wp-admin access by IP
<Directory "/var/www/html/wp-admin">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>