Atomic Edge analysis of CVE-2026-1088 (metadata-based):
The Login Page Editor plugin for WordPress versions up to and including 1.2 contains a Cross-Site Request Forgery vulnerability. This flaw allows unauthenticated attackers to modify the plugin’s login page settings by tricking an administrator into performing an action like clicking a malicious link. The vulnerability resides in the AJAX handler for the devotion_loginform_process action.
Atomic Edge research identifies the root cause as missing nonce validation on the devotion_loginform_process AJAX action. WordPress AJAX handlers require a nonce (number used once) parameter to verify the request originates from a legitimate user session. The plugin’s AJAX callback function processes requests without checking the nonce value. This conclusion is inferred from the CWE-352 classification and the vulnerability description stating missing nonce validation. Without examining the source code, Atomic Edge cannot confirm whether proper capability checks exist alongside the missing nonce validation.
Exploitation requires an attacker to craft a malicious webpage containing a forged HTTP request. When an authenticated administrator visits this page, their browser automatically sends a POST request to the WordPress site’s admin-ajax.php endpoint. The request must include action=devotion_loginform_process and any parameters the plugin’s settings update function accepts. The attacker would likely target parameters controlling login page appearance, redirect URLs, or custom CSS/HTML injection points. A successful attack would modify the plugin’s stored settings without the administrator’s knowledge or consent.
Remediation requires adding nonce verification to the devotion_loginform_process AJAX handler. The plugin should call wp_verify_nonce() with the appropriate nonce parameter before processing any settings changes. The nonce should be generated using wp_create_nonce() and included in the AJAX request. Proper capability checks using current_user_can() should also verify the user has appropriate permissions, typically manage_options or a plugin-specific capability. These measures follow WordPress security best practices for AJAX endpoints.
Successful exploitation allows attackers to modify the login page settings. Impact includes potential login page defacement, injection of malicious JavaScript (if the plugin allows custom HTML/CSS), or modification of login redirect URLs to phishing sites. The CVSS vector indicates low impact on confidentiality (C:N) and availability (A:N) with low impact on integrity (I:L). Attackers cannot directly escalate privileges or execute code through this vulnerability alone, but modified redirects could facilitate credential theft.
