CVE-2024-32677 MEDIUM

CVE-2024-32677: WordPress LoginPress Pro plugin < 3.0.0 - Unauth. License Activation/Deactivation vulnerability

Vendor Loginpress
Product LoginPress Pro
Weakness CWE-862 · Missing authorization
Published April 24, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

What the vulnerability does

01Description

Missing Authorization vulnerability in LoginPress LoginPress Pro.This issue affects LoginPress Pro: from n/a before 3.0.0.

Explanation of Vulnerability in Simple Terms

02Summary

LoginPress Pro versions before 3.0.0 lack proper authorization checks, allowing unauthenticated attackers to disrupt site availability. The vulnerability requires only network access and no user interaction. An attacker can trigger a denial-of-service condition by sending crafted requests to the affected component.

What an attacker can do

03Attacker Capabilities

Make the site unavailable or unresponsive to legitimate users.

Potential impact on your site

04Site Impact

Your site may become temporarily unavailable or slow without warning or user action.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

April 24, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-65445 WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability CVE-2026-65487 WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability CVE-2026-65529 WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability CVE-2026-65499 WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability CVE-2026-65457 WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability