CVE-2026-24578: 
WordPress vulnerability analysis and mitigation

CVE-2026-24578 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Admin login URL Change" by Jahid Hasan. It affects all versions up to and including 1.1.5, and was reported by Mohamad Fattyr on December 21, 2025, with public disclosure on January 23, 2026. The vulnerability allows a low-privileged authenticated user (Subscriber level) to exploit incorrectly configured access control security levels. It carries a CVSS v3.1 base score of 4.3 (Medium), assigned by Patchstack (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning the plugin fails to perform adequate authorization checks before executing privileged actions — specifically, functions related to changing the WordPress admin login URL. An authenticated attacker with at minimum Subscriber-level access can trigger these functions without the required permissions, potentially altering the admin login URL configuration. No nonce token or capability check is enforced on the affected function, which is a common pattern in WordPress plugin broken access control issues (Patchstack).

Successful exploitation allows a low-privileged authenticated user to modify the WordPress admin login URL, which could disrupt legitimate administrator access or facilitate further attacks such as locking out administrators. The integrity impact is low (CVSS I:L), with no direct confidentiality or availability impact. While the individual impact is limited, this type of misconfiguration can be chained with other vulnerabilities or used in mass-exploit campaigns targeting large numbers of WordPress sites (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns against WordPress sites regardless of their size or traffic (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Admin login URL Change" plugin version 1.1.5 or earlier, using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/admin-login-url-change/readme.txt.
2. Authentication: Obtain or register a low-privileged account (e.g., Subscriber) on the target WordPress site.
3. Trigger unauthorized action: Send a crafted authenticated HTTP request (e.g., POST) to the WordPress admin-ajax endpoint or the relevant plugin action that handles the admin login URL change, bypassing the missing authorization check.
4. Modify admin login URL: Successfully alter the admin login URL setting, potentially redirecting or disrupting legitimate administrator access to the WordPress backend (Patchstack).

• Logs: WordPress access logs showing authenticated POST requests to wp-admin/admin-ajax.php or plugin-specific endpoints from low-privileged user accounts, particularly with action parameters related to login URL configuration changes.
• WordPress Activity: Unexpected changes to the admin login URL setting in the plugin's configuration, detectable via WordPress audit log plugins (e.g., WP Activity Log).
• File System: No direct file system artifacts expected, but review plugin option values in the WordPress database (wp_options table) for unexpected modifications to the admin login URL setting.

The vulnerability is patched in version 1.1.6 of the "Admin login URL Change" plugin. Site administrators should update to version 1.1.6 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, consider temporarily deactivating the plugin and consulting your hosting provider or web developer (Patchstack).