CVE-2026-1398 is a CSRF vulnerability in the Change WP URL plugin for WordPress, affecting all versions up to 1.0. The issue arises from missing or incorrect nonce validation on the 'change-wp-url' page, enabling attackers to perform unauthorized changes to the WordPress login URL by tricking an administrator into clicking a malicious link. The vulnerability has a CVSS 3.1 base score of 4.3 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on integrity only.

An attacker can cause an administrator to unknowingly change the WordPress login URL via a forged request, potentially disrupting site access or enabling further attacks that rely on obscuring the login page. There is no direct confidentiality or availability impact reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious about clicking links from untrusted sources and consider implementing additional CSRF protections or monitoring for unauthorized changes to the login URL. No official patch or workaround is currently documented.