{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1764", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-27T17:32:23.402Z", "datePublished": "2025-03-14T05:24:01.947Z", "dateUpdated": "2026-04-08T17:11:40.910Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:40.910Z"}, "affected": [{"vendor": "hiddenpearls", "product": "LoginPress | wp-login Custom Login Page Customizer", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.3.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}], "title": "LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9df6a2b4-2dc4-43dd-8282-5c05b0fa13f6?source=cve"}, {"url": "https://plugins.svn.wordpress.org/loginpress/trunk/lib/wpb-sdk/views/wpb-debug.php"}, {"url": "https://pt.wordpress.org/plugins/loginpress/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3253283/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "cweId": "CWE-352", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira"}], "timeline": [{"time": "2025-03-13T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-14T13:44:01.067393Z", "id": "CVE-2025-1764", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:44:27.868Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1764", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-14T13:44:01.067393Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-14T13:44:18.160Z"}}], "cna": {"title": "LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update", "credits": [{"lang": "en", "type": "finder", "value": "Carlos Ferreira"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "hiddenpearls", "product": "LoginPress | wp-login Custom Login Page Customizer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.3.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-03-13T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9df6a2b4-2dc4-43dd-8282-5c05b0fa13f6?source=cve"}, {"url": "https://plugins.svn.wordpress.org/loginpress/trunk/lib/wpb-sdk/views/wpb-debug.php"}, {"url": "https://pt.wordpress.org/plugins/loginpress/"}, {"url": "https://plugins.trac.wordpress.org/changeset/3253283/"}], "descriptions": [{"lang": "en", "value": "The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-03-14T05:24:01.947Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1764", "state": "PUBLISHED", "dateUpdated": "2025-03-14T13:44:27.868Z", "dateReserved": "2025-02-27T17:32:23.402Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-14T05:24:01.947Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability."}, {"lang": "es", "value": "El complemento LoginPress | wp-login Custom Login Page Customizer para WordPress es vulnerable a Cross-Site Request Forgery en todas las versiones hasta la 3.3.1 incluida. Esto se debe a la falta o a una validaci\u00f3n incorrecta de nonce en la funci\u00f3n 'custom_plugin_set_option'. Esto permite que atacantes no autenticados actualicen opciones arbitrarias en el sitio de WordPress mediante una solicitud falsificada, ya que pueden enga\u00f1ar al administrador del sitio para que realice una acci\u00f3n como hacer clic en un enlace. Esto puede aprovecharse para actualizar el rol predeterminado de registro a administrador y habilitar el registro de usuarios para que los atacantes obtengan acceso administrativo a un sitio vulnerable. La constante 'WPBRIGADE_SDK__DEV_MODE' debe establecerse en 'true' para explotar la vulnerabilidad."}], "id": "CVE-2025-1764", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-03-14T06:15:24.860", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/loginpress/trunk/lib/wpb-sdk/views/wpb-debug.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3253283/"}, {"source": "security@wordfence.com", "url": "https://pt.wordpress.org/plugins/loginpress/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9df6a2b4-2dc4-43dd-8282-5c05b0fa13f6?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T01:55:50.182313+00:00", "value": {"mitigation_remediation": ["Upgrade the LoginPress plugin to version 3.4 or later, where the nonce validation bug is fixed.", "If an immediate upgrade is not possible, set WPBRIGADE_SDK__DEV_MODE to false or remove the constant from the code base so the exploitation path is closed.", "Review the site\u2019s user registration and default role settings; disable registration or set the default role to a non\u2011admin level and audit existing accounts for unauthorized administrators."], "summary": {"action": "Immediate Patch", "impact": "Privilege Escalation via Option Modification"}, "threat_synthesis": {"affected_systems": "The vulnerability affects versions of the hiddenpearls LoginPress plugin up to and including 3.3.1. These versions are WordPress plugins that customize the login page. Only installations where the WPBRIGADE_SDK__DEV_MODE constant is set to true can be exploited. No other products or versions are currently known to be affected.", "description_and_impact": "The LoginPress | wp-login Custom Login Page Customizer plugin contains a flaw where the custom_plugin_set_option function does not correctly verify a nonce. As a result, anyone can send a forged HTTP request and update any WordPress option without authentication. If the site is running in developer mode\u2014indicated by the WPBRIGADE_SDK__DEV_MODE constant set to true\u2014an attacker can change the default role assigned to newly registered users to administrator and enable the registration feature. This allows the creation of a fully privileged administrator account solely through a click\u2011through CSRF attack, compromising the integrity of the site configuration and effectively providing remote administrative control.", "risk_and_exploitability": "The flaw carries a CVSS score of 7.5, indicating high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. An attacker must obtain a victim\u2011administrator\u2019s interaction\u2014typically by luring them to click a malicious link\u2014to trigger the CSRF request. Successful exploitation results in the modification of critical WordPress settings and the creation of an attacker\u2011controlled administrator account, giving full control over the site."}}}}, "created": "2025-07-12T22:09:54.130156+00:00", "updated": "2026-04-22T02:00:05.040145+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}