CVE-2026-1398

The Change WP URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'change-wp-url' page. This makes it possible for unauthenticated attackers to change the WP Login URL via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

• CWE-352

• https://plugins.trac.wordpress.org/browser/change-wp-url/tags/1.0/change-wp-url.php#L18
• https://plugins.trac.wordpress.org/browser/change-wp-url/tags/1.0/change-wp-url.php#L85
• https://plugins.trac.wordpress.org/browser/change-wp-url/trunk/change-wp-url.php#L18
• https://plugins.trac.wordpress.org/browser/change-wp-url/trunk/change-wp-url.php#L85
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f5dead05-5960-4ccb-89c2-c8bb0cd9c9e9?source=cve

Published

Jan 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-13974Integer overflow in Safe Browsing in Google Chrome on Mac pr…8.1
• CVE-2026-13975Out of bounds read in ANGLE in Google Chrome on Mac prior to…5.3
• CVE-2026-13976Insufficient data validation in Storage in Google Chrome pri…5.8
• CVE-2026-13977Inappropriate implementation in HTMLParser in Google Chrome …5.4
• CVE-2026-13978Insufficient policy enforcement in PageInfo in Google Chrome…4.3
• CVE-2026-13979Inappropriate implementation in Paint in Google Chrome prior…4.3
• CVE-2026-13980Inappropriate implementation in Chrome for iOS in Google Chr…4.3
• CVE-2026-13981Inappropriate implementation in Chrome for iOS in Google Chr…4.3
• CVE-2026-13982Incorrect security UI in Passwords in Google Chrome prior to…3.1
• CVE-2026-13983Inappropriate implementation in Chrome for iOS in Google Chr…4.2
• CVE-2026-13984Incorrect security UI in TabStrip in Google Chrome prior to …4.3
• CVE-2026-13985Inappropriate implementation in MediaCapture in Google Chrom…6.5