CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.
Explanation of Vulnerability in Simple Terms
Login Lockdown & Protection versions 2.14 and earlier contain a use of insufficiently random values (CWE-330) that allows an attacker to predict or manipulate security tokens without authentication. The vulnerability affects the integrity of the plugin's protection mechanisms. Site administrators should update to a version newer than 2.14 when available.
What an attacker can do
Predict or forge security tokens to bypass the plugin's lockdown protections.
Potential impact on your site
Attackers can circumvent login protection and lockdown features designed to prevent brute-force attacks.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
