Login Lockdown
Monthly
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.