WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update

The primary impact of this CSRF vulnerability lies in the potential for unauthorized modification of the WP Custom Admin Login Page Logo plugin's settings. An attacker could leverage this to alter the login page's appearance, branding, or other configurations. While seemingly cosmetic, these changes could be used to obfuscate malicious login pages or redirect users to phishing sites, ultimately compromising user credentials. The attack relies on social engineering to trick an administrator into clicking a malicious link, making user awareness a crucial factor in mitigating the risk. Successful exploitation could lead to brand impersonation and user trust erosion.

WordPress websites utilizing the WP Custom Admin Login Page Logo plugin, particularly those with administrator accounts that are not protected by strong passwords or two-factor authentication, are at risk. Shared hosting environments where plugin updates are not managed centrally are also more vulnerable.

• wordpress / composer / npm:

grep -r 'wpclpl_save' /var/www/html/wp-content/plugins/wp-custom-admin-login-page-logo/

• wordpress / composer / npm:

wp plugin list --status=all | grep 'wp-custom-admin-login-page-logo'

• wordpress / composer / npm:

wp plugin update wp-custom-admin-login-page-logo

• generic web: Inspect HTTP requests for the plugin's endpoints for missing or improperly validated CSRF tokens.

1. 2025-11-11Disclosure

   disclosure

1. Reserviert2025-10-23
2. Veröffentlicht2025-11-11
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The immediate mitigation for CVE-2025-12132 is to upgrade the WP Custom Admin Login Page Logo plugin to a version that addresses the vulnerability. As a temporary workaround, consider implementing strict Content Security Policy (CSP) headers to restrict the sources from which the plugin can load resources. Additionally, enforce strong password policies and enable two-factor authentication (2FA) for all administrator accounts to reduce the risk of successful social engineering attacks. Monitor WordPress plugin activity logs for any suspicious modifications to the plugin's settings. After upgrading, verify the plugin's configuration and ensure no unauthorized changes have been made.