MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update

An unauthenticated attacker can craft a malicious HTML form that submits a POST request to the WordPress admin area with arbitrary values for plugin settings such as `mpclp-login-image`, `mpclp-login-message`, and button colors. Because the nonce validation is broken (inverted check and missing action parameter), the request passes through without verification. The attacker then tricks a logged-in administrator into submitting this form (e.g., via a social-engineering link or embedded form), resulting in a Cross-Site Request Forgery (CSRF) attack that silently modifies all plugin settings.

The vulnerability resides in the `enter_mpclp_login_options()` function in `class.mp-customize-login-page.php` [ref_id=1]. The nonce check is inverted (`if ( wp_verify_nonce( $_POST['_wpnonce'] ) ){ return false; }`) and omits the required action parameter, making it dead code that never blocks requests. Additionally, the handler is hooked on `init` without any capability check, so no authentication or authorization is enforced before updating plugin settings.

The patch is not included in the bundle, but the advisory explains that the fix must correct the nonce validation in `enter_mpclp_login_options()` by calling `wp_verify_nonce()` with the proper action parameter and using a correct conditional (`if ( ! wp_verify_nonce( ... ) )`), and should also add a capability check (e.g., `current_user_can('manage_options')`) before processing settings updates. Without these changes, the nonce check is dead code and the handler is accessible to any unauthenticated request.