Rename Wp-Login.php to Anything You Want (<= 2.0.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/rename-wp-login.php-to-anything-you-want--2.0.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 23 Sep 2026 10:42:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgSQL Injection in Rename wp-login.php WordPress Pluginhttps://feed.craftedsignal.io/briefs/2026-09-wordpress-sqli/Wed, 23 Sep 2026 10:42:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-wordpress-sqli/The 'Rename wp-login.php to anything you want' WordPress plugin is vulnerable to unauthenticated time-based SQL injection via the 'log' parameter, allowing sensitive database information extraction.The 'Rename wp-login.php to anything you want' plugin for WordPress (all versions up to and including 2.0.1) contains a critical security vulnerability identified as CVE-2026-93368. The vulnerability is a time-based SQL injection occurring within the 'log' (username) parameter. The flaw stems from insufficient input sanitization and the application of WordPress core 'wp_unslash()' function on user-supplied data before it reaches the plugin's handler. By stripping backslash escaping, this function allows raw single quotes to reach the database query unimpeded. Unauthenticated attackers can leverage this to append malicious SQL queries to existing ones, potentially leading to unauthorized data exfiltration from the WordPress database. Given that the 'log' parameter is processed during login attempts, this provides an accessible vector for attackers to perform blind SQL injection attacks by measuring database response times.

Impact

Successful exploitation allows unauthenticated attackers to perform SQL injection against the underlying database. This could result in unauthorized access to sensitive information stored in the WordPress database, including user credentials, configuration data, and site content. Since the vulnerability does not require administrative privileges, any internet-facing WordPress site running this plugin version is at risk of information disclosure.

Recommendation

Immediate action is required for all WordPress installations utilizing the 'Rename wp-login.php to anything you want' plugin.

  • Update the plugin to the latest version (patch for CVE-2026-93368) as soon as it is released by the developer.
  • If an update is unavailable, deactivate and uninstall the plugin to eliminate the vulnerable code path.
  • Implement Web Application Firewall (WAF) rules to inspect the 'log' parameter for common SQL injection characters (such as single quotes and sleep/benchmark functions) specifically targeting requests to the plugin's custom login endpoint.
  • Monitor web server logs for suspicious POST requests to the login page containing SQL injection patterns.
]]>highadvisory