CVE-2024-32676 MEDIUM

CVE-2024-32676: WordPress LoginPress Pro plugin < 3.0.0 - Captcha Bypass vulnerability

Vendor Loginpress

Product LoginPress Pro

Weakness CWE-307 · Brute force

Published April 25, 2024

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

5.3/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Improper Restriction of Excessive Authentication Attempts vulnerability in LoginPress LoginPress Pro allows Removing Important Client Functionality.This issue affects LoginPress Pro: from n/a before 3.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

LoginPress Pro versions before 3.0.0 contain a weakness in password reset token generation that allows attackers to predict or brute-force reset tokens without authentication. An attacker can use this to reset user passwords and gain unauthorized account access. Update to version 3.0.0 or later to fix the vulnerability.

What an attacker can do

03Attacker Capabilities

Reset user passwords and take over accounts without knowing the current password.

Potential impact on your site

04Site Impact

User accounts can be compromised if attackers reset passwords and log in as legitimate users.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 25, 2024 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-32676 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/307.html AskarLabs — CWE-307 write-up Improper Restriction of Excessive Authentication Attempts

Related vulnerabilities