CVE-2026-1088

The Login Page Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2. This is due to missing nonce validation on the devotion_loginform_process() AJAX action. This makes it possible for unauthenticated attackers to update the plugin's login page settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/login-page-editor/tags/1.2/class/devotion.core.class.php#L50
• https://plugins.trac.wordpress.org/browser/login-page-editor/trunk/class/devotion.core.class.php#L50
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f428b90d-8830-445d-b1f1-d8f860dae5cf?source=cve

Published

Jan 24, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-10874A vulnerability was identified in projectworlds Online Art G…6.3
• CVE-2026-10875A security flaw has been discovered in projectworlds Online …6.3
• CVE-2026-10876A weakness has been identified in SourceCodester Ship Ferry …6.3
• CVE-2026-10877A security vulnerability has been detected in SourceCodester…7.3
• CVE-2026-10878A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.7…8.8
• CVE-2026-10879DBI versions before 1.648 for Perl have a heap overflow when…9.8
• CVE-2026-10880OSNexus QuantaStor SDS Manager is vulnerable to SQL injectio…9.8
• CVE-2026-10881Out of bounds read and write in ANGLE in Google Chrome prior…9.6
• CVE-2026-10882Use after free in Network in Google Chrome prior to 149.0.78…8.8
• CVE-2026-10883Type Confusion in ANGLE in Google Chrome prior to 149.0.7827…8.8
• CVE-2026-10884Use after free in Chromecast in Google Chrome prior to 149.0…8.3
• CVE-2026-10885Use after free in Chrome for iOS in Google Chrome on iOS pri…8.8