The Login Lockdown & Protection plug‑in for WordPress contains an authorization bypass that lets any authenticated user with at least Subscriber privileges create a valid nonce and then fashion a global unlock key. That key can be used to add arbitrary IP addresses to the plug‑in's allowlist, effectively circumventing the IP restrictions that the plug‑in is designed to enforce. The flaw stems from a missing capability check in the ajax_run_tool function and is mitigated only when a site administrator has already visited the loginlockdown settings page, which is not a default scenario on new installations.

This issue affects versions of the webfactory Login Lockdown & Protection plug‑in from the inception of the software through version 2.11 inclusive. Only WordPress sites that have not yet had their site administrator visit the loginlockdown page are vulnerable, as the missing check only operates when the admin‑only mode hasn't been activated.

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of active exploitation. The plug‑in is not listed in the CISA KEV catalog, further supporting the notion that the vulnerability is unlikely to have been widely abused. The attack requires the attacker to already be an authenticated user with Subscriber or higher capability within the WordPress installation and the plug‑in must still be running in its default configuration. Under those conditions, the missing authorization check allows the attacker to widen the allowed IP list, giving them persistent or future access that would normally be restricted. The vulnerability is contained to the plug‑in configuration and does not provide remote code execution or database intrusion by itself. However, once an attacker can add an IP to the allowlist, any future unauthenticated exploitation that relies on that IP would succeed, making the flaw a valuable stepping stone for continued compromise.