The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
CVSS
No CVSS.
References
Configurations
History
27 Feb 2025, 22:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Webfactoryltd
Webfactoryltd wp Login Lockdown |
|
| CPE | cpe:2.3:a:webfactoryltd:wp_login_lockdown:*:*:*:*:*:wordpress:*:* | |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail= - Patch | |
| References | () https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve - Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492 - Product |
29 Feb 2024, 01:43
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-02-29 01:43
Updated : 2025-02-27 22:03
NVD link : CVE-2024-1340
Mitre link : CVE-2024-1340
JSON object : View
Products Affected
webfactoryltd
- wp_login_lockdown
CWE
No CWE.