PT-2025-51054 · WordPress · Login Lockdown & Protection

William Cooke · Published 2025-12-13 · Updated 2025-12-13 · CVE-2025-11707

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Login Lockdown & Protection plugin for WordPress versions up to and including 2.14

Description The Login Lockdown & Protection plugin for WordPress is susceptible to an IP block bypass. This occurs because the $unblock key key is not sufficiently random. Unauthenticated users who have access to an administrative user email can generate valid unblock keys for their IP address. This allows attackers to circumvent IP address blocks implemented to prevent brute-force login attempts.

Recommendations Update the Login Lockdown & Protection plugin to a version later than 2.14.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2025-11707

Affected Products

Login Lockdown & Protection

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-11707 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve · Note
• https://t.me/CVEtracker/39692 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=3389843%40login-lockdown&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1999865349458874642 · Twitter Post
• https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php · Note