{"id":"CVE-2026-110691","revision":"3f5fa856fa1b49c19d59f7c3b0e8b722","records":[{"revision":"3f5fa856fa1b49c19d59f7c3b0e8b722","observedAt":"2026-10-28T18:46:48.818+00:00","statement":{"source":"cve-program","id":"CVE-2026-110691","aliases":[],"title":"WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update","description":"The WPOrLogin  WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.","state":0,"publishedAt":"2026-10-28T06:00:23.955+00:00","modifiedAt":"2026-10-28T17:58:06.9+00:00","affected":[{"ecosystem":"Vendor product","name":"WPOrLogin","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WPOrLogin\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.1.0\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/1a5731c4-1bca-4136-bfa8-37e30e86c588/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110691","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110691","identifiers":["CVE-2026-110691"]},"retained":false,"historicalAffected":[]}],"coverage":[]}