CVE-2025-58969

The Custom Login URL plugin for WordPress versions up to 1.0.2 contains a missing authorization vulnerability [1]. This allows exploitation of incorrectly configured access control security levels, enabling unprivileged users to execute actions intended for higher-privileged roles.

An unauthenticated attacker can exploit this flaw by sending crafted requests to the plugin, bypassing authorization checks to perform privileged actions [1]. No authentication is required, making the attack vector accessible from the public internet.

Successful exploitation could allow an attacker to modify sensitive plugin settings, such as custom login URLs, potentially redirecting users to malicious sites or disrupting authentication [1]. The CVSS score is 5.3 (Medium), though the vendor rates it as low severity and unlikely to be widely exploited.

The vulnerability is patched in version 1.0.3. Users are urged to update immediately. Patchstack users can enable auto-updates for vulnerable plugins [1]. If unable to update, consult hosting providers or web developers for assistance.