The WordPress Login Lockdown plugin versions up to 2.17 contain an unauthenticated bypass that removes the authentication barrier imposed by the plugin, effectively letting an attacker access protected areas of the site without credentials. This weakness is classified under CWE‑290 and has a CVSS score of 4.8, indicating moderate severity. According to the description, the flaw does not enable code execution or privilege escalation; it merely allows an unauthenticated user to circumvent the lockout protection set by the plugin.

Affected systems are installations of the WebFactory Login Lockdown plugin for WordPress that run version 2.17 or earlier. Any WordPress site that has not upgraded to at least version 2.18 is vulnerable. No other vendors or product versions are listed as impacted.

The CVSS score of 4.8 reflects the moderate impact of gaining unauthorized administrative or other protected access. EPSS score is 0.00193, indicating a very low exploitation probability. The vulnerability is not listed in CISA KEV, suggesting no documented large‑scale exploitation. The attack vector is remote, most likely through crafted HTTP requests to the login page that bypass the plugin’s lockout mechanism. Because it does not allow remote code execution, the risk is confined to unauthorized access, though this could serve as a foothold for further attacks if the attacker takes advantage of other site vulnerabilities.