WordPress Login Page Editor Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the Login Page Editor plugin for WordPress, affecting all versions up to and including 1.2. The vulnerability arises from a lack of nonce validation in the 'devotion_loginform_process()' AJAX action, allowing unauthenticated attackers to manipulate the plugin's login page settings. Exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability allows for unauthorized changes to be made to the login page settings of the affected WordPress site.