CVE-2026-93368 describes a time-based SQL Injection vulnerability in the 'Rename wp-login.php to anything you want' WordPress plugin by travispluse. The flaw exists in all versions up to and including 2.0.1 due to improper neutralization of special elements in SQL commands (CWE-89). Specifically, the 'log' parameter is not properly escaped or prepared before being used in SQL queries, enabling unauthenticated attackers to append malicious SQL statements. WordPress core's wp_unslash() function removes backslash escaping from the 'log' parameter before the plugin processes it, allowing raw single quotes to be injected into SQL statements.

An unauthenticated attacker can exploit this vulnerability to perform time-based SQL Injection attacks, potentially extracting sensitive information from the database. The vulnerability does not directly allow modification or deletion of data but can lead to disclosure of confidential data. The CVSS score of 7.5 (high) reflects the network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider disabling or removing the affected plugin version to mitigate risk. Monitoring for updates from the vendor or trusted security sources is recommended.