Login Lockdown EUVD-2026-93068

Applies to WordPress sites running the WebFactory Login Lockdown plugin at version 2.17 or earlier where the plugin is actively used to enforce login lockout/throttling. Exploitation requires network access to the login endpoint but no authentication (PR:N) and no user interaction (UI:N). The key limiting factor is the HIGH attack complexity (AC:H): the attacker must manipulate whatever client attribute (such as a spoofable source identifier/header) the plugin uses to count and lock failed attempts, so success depends on reproducing that bypass condition reliably. Impact is bounded to defeating the lockdown control, which facilitates brute-force rather than granting direct access by itself.

This is a moderate-severity (CVSS 4.8) authentication-protection bypass in the Login Lockdown WordPress plugin, reported by Patchstack and mapped to CWE-290 (Authentication Bypass by Spoofing). The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates a network-reachable, unauthenticated issue but with HIGH attack complexity and only LOW confidentiality/integrity impact and no availability impact - consistent with defeating the plugin's lockout control rather than directly compromising the site. No EPSS score was provided in the input, the CVE is NOT on the CISA KEV list, and no public exploit code (POC) is referenced; the single reference is the Patchstack advisory. Net assessment: this is a real but secondary-priority defensive-control weakness, not a high-urgency flaw. The practical risk is amplification of credential-stuffing/brute-force attacks because the very feature meant to throttle them can be evaded; it is not itself a direct account takeover. No SSVC decision data was supplied. Prioritize patching on sites that rely on Login Lockdown as a primary brute-force defense, but it does not warrant emergency response absent exploitation signals.

An attacker running a brute-force or credential-stuffing campaign against a WordPress login page crafts requests that evade Login Lockdown's failed-attempt tracking/lockout, allowing them to continue guessing credentials without being blocked after the configured threshold. Because exploitation is unauthenticated and network-based but marked high-complexity, it likely requires specific request manipulation (e.g., spoofing the client identity the plugin uses to count attempts). No public exploit code is identified at time of analysis.