PT-2024-17959 · WordPress · The Login Lockdown – Protect Login Form

Lucio Sá · Published 2024-02-20 · Updated 2024-02-29 · CVE-2024-1340

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Login Lockdown – Protect Login Form plugin for WordPress versions up to, and including, 2.08

Description The issue is related to a missing capability check on the generate export file function. This allows authenticated attackers with subscriber access or higher to export the plugin's settings, which include whitelisted IP addresses and a global unlock key. The global unlock key can be used by an attacker to add their IP address to the whitelist.

Recommendations For versions up to, and including, 2.08, update to a version that includes a fix for the missing capability check on the generate export file function to prevent unauthorized access to the plugin's settings. As a temporary workaround, consider restricting access to the generate export file function to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2024-1340

Affected Products

The Login Lockdown – Protect Login Form

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2024-1340 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail= · Patch
• https://osv.dev/vulnerability/CVE-2024-1340 · Vendor Advisory
• https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492 · Note
• https://twitter.com/CVEnew/status/1760025924182196636 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve · Note