Input validation vulnerability in CLP – Custom Login Page by NiteoThemes 1.5.5

A popular WordPress plugin called CLP – Custom Login Page by NiteoThemes has a security issue. This issue, known as Cross-Site Request Forgery, affects all versions of the plugin up to 1.5.5. Essentially, the plugin does not properly check for a special code called a nonce, which is meant to prevent unauthorized actions. This means that someone without an account on the website can trick the website administrator into doing something they shouldn’t, like clicking on a harmful link.