PT-2025-2209 · WordPress · The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login Url – Sign In
Theviper17Y
+1
·
Published
2025-01-31
·
Updated
2025-01-31
·
CVE-2024-13530
CVSS v3.1
4.3
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login URL – Sign in , Sign out plugin for WordPress versions up to, and including, 7.1.1
Description
The issue is related to unauthorized access due to a missing capability check on the
lps handle delete all logs(), lps handle delete login log(), and lps handle end session() functions. This allows authenticated attackers with Subscriber-level access and above to delete login logs and end user sessions.Recommendations
For versions up to, and including, 7.1.1, consider disabling the
lps handle delete all logs(), lps handle delete login log(), and lps handle end session() functions until a patch is available to prevent unauthorized access. Restrict access to these functions to minimize the risk of exploitation.Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
The Custom Login Page Styler – Limit Login Attempts – Restrict Content With Login – Redirect After Login – Change Login Url – Sign In