CVE-2024-1340

MEDIUM

Login Lockdown - Protect Login Form < 2.09 - Authenticated Unauthorized Data Access via generate_export_file Function

Title source: llm

Description

The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.

References (3)

Core 3

Core References

Product

https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492

Patch

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail=

Third Party Advisory

https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve

Scores

CVSS v3 5.4

EPSS 0.0039

EPSS Percentile 31.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-862

Status published

Products (2)

webfactory/Login Lockdown & Protection < 2.08

webfactoryltd/wp_login_lockdown < 2.09

Published Feb 29, 2024

Tracked Since Feb 18, 2026