CVE-2024-1340CWE-862

Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization

Medium · published February 20, 2024

CVSS v3.1
5.4
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-02-20T18:56Z
EPSS history
Timeline
  • 20 FEB 18:56Z
    Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
    cvelistv5