PT-2022-13440 · WordPress · Limit Login Attempts

Cydave · Published 2022-03-28 · Updated 2022-04-04 · CVE-2022-0787

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Limit Login Attempts (Spam Protection) WordPress plugin versions prior to 5.1

Description The issue concerns the Limit Login Attempts (Spam Protection) WordPress plugin, where certain parameters are not properly sanitized and escaped before being used in SQL statements via AJAX actions. This can lead to SQL injections, and these AJAX actions are available to unauthenticated users.

Recommendations For versions prior to 5.1, update to version 5.1 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0787

Affected Products

Limit Login Attempts

References · 3

• 🔥 https://wpscan.com/vulnerability/69329a8a-2cbe-4f99-a367-b152bd85b3dd · Exploit
• https://osv.dev/vulnerability/CVE-2022-0787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0787 · Security Note