Super Custom Login
Super Custom Login has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it remains unpatched as of August 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Super Custom Login has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2026.
All of these findings were reported by Legion Hunter. Super Custom Login is installed on roughly 100 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.2.11.
CVE-2026-39605Super Custom Login <= 1.1 - Missing Authorization
Read the full analysisVulnerability Records
Super Custom Login
Author
Obadiah
This plugin offers customization options for the WordPress login screen, including the ability to replace the default WordPress logo with a custom logo that links to the user’s homepage. There are custom color settings for all elements on login page. Additionally, the plugin improves login security by removing error messages upon failed login attempts. To utilize the custom logo feature, users should first upload their logo (ideally as a transparent PNG) to their media library where the URL can by copied. Install the plugin and go to the settings page. Enter the URL. Enter width and height of logo, if different from defaults. Click “Save Changes”.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C