CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked.
Explanation of Vulnerability in Simple Terms
The Lock User Account plugin for an unspecified CMS contains a flaw that allows authenticated users with low privileges to read sensitive data or modify non-critical information. The vulnerability requires network access and difficult conditions to exploit. No availability impact occurs. Update to a version newer than 1.0.5 when available.
What an attacker can do
Read sensitive data or modify non-critical information on the site.
Potential impact on your site
Authenticated users may access or alter data they should not be able to reach, depending on plugin configuration.
Conditions required to exploit
Attacker must be authenticated with low-level user privileges and exploit difficult network conditions.
Key dates
External resources
Related vulnerabilities
