Skip to content
Sign in
5.3 Medium

CVE-2025-11707 The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and…

Description

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.

Affected products and versions

Product Affected versions Fixed in
Login Lockdown & Protection 2.14 earliest → 2.14 No fix stated

Other CVEs of Login Lockdown & Protection

The 3 CVEs of Login Lockdown & Protection →
CVE-2025-3766 The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing… 5.4 Medium CVE-2024-1340 The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a… 5.4 Medium
Track this CVE