CVE-2026-6292 describes a CSRF vulnerability in the MP Customize Login Page plugin for WordPress, affecting all versions up to and including 1.0. The vulnerability is caused by a broken nonce validation in the enter_mpclp_login_options() function, where the nonce check is inverted (if wp_verify_nonce(...) { return false; }) and lacks the required action parameter, effectively disabling nonce protection. Additionally, the settings-update handler is hooked on the init action without any capability checks, allowing unauthenticated attackers to modify plugin settings by tricking an authenticated administrator into submitting a malicious request. This can lead to unauthorized changes to login page appearance and messages.

An attacker can exploit this vulnerability to modify all plugin settings, including login page background, logo URL, image dimensions, button colors, and login message, without authentication. This could result in unauthorized visual changes to the login page, potentially facilitating phishing or social engineering attacks. There is no direct confidentiality or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid interacting with untrusted links or sites while logged into WordPress and consider disabling or removing the vulnerable plugin to prevent exploitation.