CVE-2025-11707mediumCWE-330

CVE-2025-11707: medium-severity vulnerability in webfactory Login Lockdown & Protection

Login Lockdown & Protection <= 2.14 - IP Block Bypass

Published · Updated

Follow this CVE+ Monitor Login Lockdown & Protection

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.5%
The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
webfactory · Login Lockdown & Protection
Related CVEs — webfactory Login Lockdown & Protection

In the same product, most dangerous first.

CVE-2024-1340MEDIUMLogin Lockdown – Protect Login Form <= 2.08 - Missing AuthorizationEPSS 0.4%CVE-2025-3766MEDIUMLogin Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP WhitelistingEPSS 0.3%