What the vulnerability does
01Description
The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. This can only by exploited on new installations where the site administrator hasn't visited the loginlockdown page yet.
Explanation of Vulnerability in Simple Terms
02Summary
Login Lockdown & Protection versions 2.11 and earlier lack proper authorization checks, allowing authenticated users with low privileges to read or modify sensitive data. An attacker with a basic user account can access functionality that should be restricted to administrators. The vulnerability requires network access and an active login but does not affect site availability.
What an attacker can do
03Attacker Capabilities
Read or modify sensitive data that should be restricted to administrators.
Potential impact on your site
04Site Impact
Unauthorized users can access admin-level features of the Login Lockdown plugin, risking data exposure or misconfiguration.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site and network access.
Key dates
06Disclosure timeline
May 7, 2025
CVE published
April 8, 2026
Record updated
