CVE-2025-3766: Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting
First published: Wed May 07 2025(Updated: )
The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. This can only by exploited on new installations where the site administrator hasn't visited the loginlockdown page yet.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Login Lockdown | <=2.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-3766?
CVE-2025-3766 has a medium severity level as it allows authenticated attackers to exploit nonce access due to a missing capability check.
How do I fix CVE-2025-3766?
To fix CVE-2025-3766, update the Login Lockdown & Protection plugin to the latest version available beyond 2.11.
Who is affected by CVE-2025-3766?
CVE-2025-3766 affects users of the Login Lockdown & Protection plugin for WordPress, specifically versions up to and including 2.11.
What are the consequences of CVE-2025-3766?
The consequences of CVE-2025-3766 include unauthorized access to certain functionalities for attackers with Subscriber-level access.
Is there a workaround for CVE-2025-3766?
Currently, the best workaround for CVE-2025-3766 is to disable the vulnerable plugin until an update can be applied.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/references
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/author
- agent/severity
- agent/source
- agent/tags
- agent/event
- vendor/login lockdown
- canonical/login lockdown