Executive brief
The "Rename wp-login.php to anything you want" plugin for WordPress contains a time-based SQL injection vulnerability in the login form's username field. Unauthenticated attackers can exploit this flaw to extract sensitive data from the WordPress database, including user credentials and other confidential information stored in the database without needing valid login credentials.
Technical details
The plugin fails to properly escape the 'log' (username) POST parameter before using it in SQL queries. WordPress core's wp_unslash() function strips magic-quotes backslash escaping when dispatching the wp_login_failed action, allowing raw single quotes to reach the plugin's handler unimpeded. This enables time-based SQL injection attacks to extract database contents.
Affected products
- Rename wp-login.php to anything you want Rename wp-login.php to anything you want up to and including 2.0.1
Timeline
- 2026-09-23: disclosed