This vulnerability in Greg Winiarski's Custom Login URL plugin arises from missing authorization checks, which allow unauthorized users to exploit improperly configured access control security levels. The affected versions include all releases up to and including 1.0.2. The CVSS 3.1 base score is 5.3 (medium), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but some integrity impact. There is no vendor advisory or patch information available at this time.

The vulnerability allows unauthorized users to perform actions that could alter data integrity due to missing authorization checks. There is no impact on confidentiality or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should carefully review and restrict access to the Custom Login URL plugin functionality to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.