WordPress Login Lockdown & Protection Plugin IP Block Bypass Vulnerability

A vulnerability exists in the Login Lockdown & Protection plugin for WordPress, affecting all versions up to and including 2.14. The issue arises from the unblock key being inadequately randomized, which allows unauthenticated users with knowledge of an administrative user's email to create valid unblock keys for their own IP addresses. This flaw enables these users to circumvent blocks imposed for excessive invalid login attempts.

Impact

Exploitation of this vulnerability allows unauthenticated users to bypass IP blocks, potentially leading to repeated login attempts and the associated risks of brute-force attacks.

Reproduction

To reproduce this vulnerability, an unauthenticated user must have access to the email address of an administrative user. The user can then request to unblock their IP by generating an unblock key using the exposed email. Once the key is created, it can be used to bypass the login attempt block.

Remediation

Users are advised to update the Login Lockdown & Protection plugin to version 2.15 or a newer patched version.