Medium severity · published Feb 20, 2024
CVE-2024-1340
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
The Login Lockdown – Protect Login Form plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the generate_export_file function in all versions up to, and including, 2.08. This makes it possible for authenticated attackers, with subscriber access and higher, to export this plugin's settings that include whitelisted IP addresses as well as a global unlock key. With the global unlock key an attacker can add their IP address to the whitelist.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LL
Login Lockdown & Protection · webfactory
through 2.08 · source: vendor
WL
WP Login Lockdown · Webfactoryltd
before 2.09 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1340
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1340
Product
https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php#L492
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3033542%40login-lockdown%2Ftrunk&old=3027788%40login-lockdown%2Ftrunk&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/34021007-b5d3-479b-a0d4-50e301f22c9c?source=cve
More from Login Lockdown & Protection
5.4
CVE-2025-3766
Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting
5.3
CVE-2025-11707
Login Lockdown & Protection <= 2.14 - IP Block Bypass