CVE-2025-11707CWE-330

CVE-2025-11707

Medium · published December 13, 2025

CVSS v3.1
5.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-330 · Use of Insufficiently Random Values
Published
2025-12-13T21:16Z
References (3)
https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php · [email protected]https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=3389843%40login-lockdown&sfp_email=&sfph_mail= · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve · [email protected]
EPSS history
Timeline
  • 13 DEC 04:31Z
    Login Lockdown & Protection <= 2.14 - IP Block Bypass
    cvelistv5