{"id":"CVE-2026-110691","aliases":[],"title":"WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"WPOrLogin","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.1.0","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-110691"}],"remediation":[],"description":"The WPOrLogin  WordPress plugin before 3.1.0 does not perform a capability check or validate a nonce before updating its hidden-login URL settings, which could allow unauthenticated attackers to reassign the login, registration and password-recovery slugs and lock the administrator out of the login interface.","severity":"unknown","score":null,"published":"2026-10-28T06:00:23.955Z","modified":"2026-10-28T17:58:06.900Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/1a5731c4-1bca-4136-bfa8-37e30e86c588/"],"sources":[{"name":"CVE","id":"CVE-2026-110691","modified":"2026-10-28T17:58:06.900Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-110691"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T01:35:32.302Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}