Description

The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-23T09:17:09.247Z",
  "pubdate": "2026-09-23T09:17:09.247Z",
  "executiveSummary": "The Rename wp-login.php plugin for WordPress is susceptible to a time-based SQL injection vulnerability affecting versions 2.0.1 and earlier.\nThe flaw originates from insufficient sanitization of the 'log' (Username) parameter, which is processed by the plugin via the wp_login_failed action.\nAn unauthenticated attacker can exploit this vulnerability to execute arbitrary SQL commands against the WordPress database, potentially leading to unauthorized data exfiltration.\nThe risk is categorized as critical due to the lack of required authentication or elevated privileges, allowing any remote user to leverage time-based inference to extract sensitive information from the backend database tables.\nSuccessful exploitation allows an attacker to manipulate query structure despite existing protections in the WordPress core, which inadvertently facilitate the injection by stripping escaping sequences via wp_unslash() before the plugin handles the input.",
  "technicalDetails": "The vulnerability resides in the way the Rename wp-login.php plugin hooks into the WordPress authentication workflow, specifically the wp_login_failed action. The plugin intercepts the 'log' parameter (representing the username) provided during a failed login attempt to perform custom logic or redirection.\nThe root cause is a failure to properly prepare SQL statements or use parameterized queries when processing the 'log' input. While WordPress core employs the wp_unslash() function to handle input data, it inadvertently removes magic-quotes backslash escaping. This allows malicious input containing raw single quotes to pass into the plugin's handler in an unescaped state.\nThe exploitation process follows a specific flow: The attacker submits a crafted POST request containing a malicious payload within the 'log' parameter. Because the plugin does not implement proper database query sanitization, the injected SQL fragment is appended to the plugin's internal database query. By leveraging time-based SQL injection techniques, such as using SLEEP() or BENCHMARK() functions combined with conditional logic (e.g., CASE statements), the attacker can systematically infer data byte-by-byte based on the server's response latency.\nThis vulnerability is particularly dangerous because it does not require authentication; the attacker operates as an unauthenticated user, interacting directly with the login process. The impact is significant, as the attacker can perform arbitrary queries, including the exfiltration of sensitive site information such as administrative credentials, configuration details, or user data stored in the wp_users table or other custom tables.\nBecause the attack occurs at the database interaction layer, the lack of input preparation allows for sophisticated manipulation of the query logic. The application fails to validate or escape the input before concatenating it into a raw SQL string, facilitating a direct injection vector that bypasses basic security assumptions made by the plugin developer. The reliance on the plugin to handle the 'log' parameter without secondary verification ensures that any payload reaching the database handler is treated as executable code by the database management system."
}