PLUGIN SECURITY
Is Change Wp Admin Login safe?
Secure and customize your WordPress login page with a custom login URL, 2FA, CAPTCHA, and more.
What this plugin does
- Slug:
change-wp-admin-login - Author: Saad Iqbal
- 60000+ active installs
- 72/100 rating (35 reviews on wordpress.org)
- 1470619 all-time downloads
- On WordPress.org since 2019-02-27
2FAcustom loginlogin securitylogin urlrecaptcha
Maintenance status
- Latest known version: 2.4.0
- Last updated: 2026-10-30 2:31pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
5 known CVEs on file for Change Wp Admin Login. Reported between 2022 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-19256 | All In One Login [change-wp-admin-login] >= 2.4.0 - < 2.5.0 | Improper Privilege Management | Unknown | 2.4.0–2.5.0 | 2.5.0 | 2026-11-05 | ⚠ update needed |
| CVE-2025-58595 | All In One Login [change-wp-admin-login] < 2.0.9 | Authentication Bypass by Spoofing | Medium 5.3 | < 2.0.9 | 2.0.9 | 2025-10-09 | ✓ fixed in latest |
| CVE-2026-94175 | All In One Login [change-wp-admin-login] < 2.5.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 2.5.0 | 2.5.0 | 2025-10-09 | ⚠ update needed |
| CVE-2023-3604 | All In One Login [change-wp-admin-login] < 1.1.4 | Observable Discrepancy | High 7.5 | < 1.1.4 | 1.1.4 | 2023-07-27 | ✓ fixed in latest |
| CVE-2022-1589 | All In One Login [change-wp-admin-login] < 1.1.0 | Cross-Site Request Forgery (CSRF) | High 7.5 | < 1.1.0 | 1.1.0 | 2022-05-09 | ✓ fixed in latest |
How to fix it
Keep Change Wp Admin Login updated — 2.4.0 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ active installs — 94/100 (5043) — max PHP 8.4
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — 98/100 (8871) — max PHP 8.4
- Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security — 1000000+ active installs — 96/100 (1489) — max PHP 8.4
- LoginPress | wp-login Custom Login Page Customizer — 200000+ active installs — 96/100 (1077) — max PHP 8.4
- Two Factor — 100000+ active installs — 94/100 (210) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.