¿Es seguro Loginpress?

Qué hace este plugin

• Slug: loginpress
• 200000+ instalaciones activas

custom loginloginlogin customizerwordpress loginwp login

Estado de mantenimiento

• Última versión conocida: 6.2.5
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

5 CVEs conocidos registrados para Loginpress.

CVE-2022-41839

Broken Access Control vulnerability leading to unauth. changing of Opt-In or Opt-Out tracking settings discovered by Nguyen Anh Tien (Patchstack Alliance) in the WordPress LoginPress plugin (versions <= 1.6.2). Update the WordPress LoginPress plugin to the latest available version (at least 1.6.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-0347

The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2019-15871

The Custom Login Page Customizer | LoginPress WordPress plugin was affected by an Unauthorized Blind SQL Injection security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2019-15872

The LoginPress plugin for WordPress is vulnerable to blind SQL Injection via Settings Import in versions up to, and including, 1.1.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

LoginPress | wp-login Custom Login Page Customizer [loginpress] < 1.1.16

The LoginPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2025-1764

The LoginPress | wp-login Custom Login Page Customizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.1. This is due to missing or incorrect nonce validation on the 'custom_plugin_set_option' function. This makes it possible for unauthenticated attackers to update arbitrary options on the WordPress site via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. The 'WPBRIGADE_SDK__DEV_MODE' constant must be set to 'true' to exploit the vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

LoginPress | wp-login Custom Login Page Customizer [loginpress] < 1.1.16

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site (including subscriber profiles). 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused due to lack of permission check on plugin settings import. Allowing any registered user to import custom settings and adjust login page. An array of functions were registered as AJAX hooks to allow calls from admin-ajax.php?action=loginpress_<functionName>` The `import` function, which is in charge of handling incoming JSON settings doesn’t have permission check, allowing all users on the site to update plugin settings. 2. SQL Injection in settings import Blind time-based SQL Injection is located within the same function as the first vulnerability. The LoginPress plugin is checking if the image is already uploaded to a local server. As you can notice, the query is not using `prepare` statement and directly making a query to the database without sanitising provided image URL. Since the function is not returning any SQL errors or response, we make use of sleep function in MySQL and compare how long it took the server to respond. Response time can be an indicator whether SQL query case is correct or not.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Loginpress actualizado — 6.2.5 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WPS Hide Login — 2000000+ instalaciones activas — 96/100 (2109) — PHP máx. 8.4
• Loginizer — 1000000+ instalaciones activas — 96/100 (1028) — PHP máx. <8.0
• Security Optimizer – The All-In-One Protection Plugin — 1000000+ instalaciones activas — 90/100 (155) — PHP máx. <8.0
• Limit Login Attempts — 300000+ instalaciones activas — 92/100 (202) — PHP máx. 8.4
• WPS Limit Login — 100000+ instalaciones activas — 98/100 (83)