CVE-2025-11707

Katalog CVE

CVSS 5.3 · Medium EPSS 0,45%

Kerentanan Use of Insufficiently Random Values. Skor CVSS 3.1 5.3 (Medium) menurut wordfence.com.

Deskripsi (NVD)

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.

Rincian

Terbit di NVD

13 Desember 2025

Terakhir diubah

7 Oktober 2026

Status NVD

Deferred

CVSS 3.1

5.3 (Medium), sumber wordfence.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

0,45% peluang dieksploitasi; lebih tinggi dari 37,4% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=...
• https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve