Login rebuilder

Login rebuilder has 2 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2023; all 2 are fixed as of September 2026. Their average CVSS score is 6.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include Cross-Site Scripting.

Every one of the 2 issues recorded for Login rebuilder has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by Taurus Omar. Login rebuilder is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.0.

Strategic Overview

Avg CVSSMedium

6.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Login rebuilder vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2014-3882

Login rebuilder < 1.2.0 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

2 records


2023-05-02 00:00	Login rebuilder <= 2.8.0 - Authenticated (Administrator+) Stored Cross-Site Scripting Login rebuilder <= 2.8.0	`CVE-2023-2223`	4.4 Medium	Taurus Omar	Yes
2014-05-14 00:00	Login rebuilder < 1.2.0 - Cross-Site Request Forgery Login rebuilder < 1.2.0	`CVE-2014-3882`	8.8 High	Anonymous	Yes

Showing 1–2 of 2 reports

Plugin Profile

Latestv2.8.8

Login rebuilder

Author

tmatsuur

5.0(7)

100/100

Last Updated

2026-01-19 (8mo ago)

Active Installs

20,000+

Downloads

266,359

Requires WP

3.2.0+

Requires PHP

5.6+

Tested up to

WP 6.9.0

Created

2013-01-18 (14y ago)

Have not you experienced unjust access to wp-login.php? If this plug-in is used, a unique login page will be arranged to your site, and unlawful access will be reduced. Some features: This plugin allows you to change wp-login.php to a login page with a unique name (multisite sub-directory type is supported). Create a login page for administrators only, and separate it from the login page for users with other roles. Disables login by email address. When an administrator logs in, the site administrator is notified by email. Selects the response when the wp-login.php page is requested. Restrict the functions that can be used, such as login via XML-RPC. Restrict REST APIs related to users. Disable the author archive page. Controls the author information of oEmbed. Support Japanese – https://elearn.jp/wpman/column/login-rebuilder.html Translators Japanese(ja) – Takenori Matsuura You can send your own language pack to me. Please contact to me. https://12net.jp/ (ja) email to takenori.matsuura[at]gmail.com @tmatsuur on twitter. Contributors Takenori Matsuura Credits This plug-in is not guaranteed though the user of WordPress can freely use this plug-in free of charge regardless of the purpose. The author must acknowledge the thing that the operation guarantee and the support in this plug-in use are not done at all beforehand. Contact email to takenori.matsuura[at]gmail.com twitter @tmatsuur

View on WordPress.org