CVE-2025-11707

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11707", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T19:44:59.728Z", "datePublished": "2025-12-13T04:31:30.625Z", "dateUpdated": "2026-04-08T17:11:26.978Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:26.978Z"}, "affected": [{"vendor": "webfactory", "product": "Login Lockdown & Protection", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.14", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts."}], "title": "Login Lockdown & Protection <= 2.14 - IP Block Bypass", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=3389843%40login-lockdown&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-330 Use of Insufficiently Random Values", "cweId": "CWE-330", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "William Cooke"}], "timeline": [{"time": "2025-12-12T15:27:33.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:25:00.484125Z", "id": "CVE-2025-11707", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:33:35.841Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11707", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:25:00.484125Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:25:02.435Z"}}], "cna": {"title": "Login Lockdown & Protection <= 2.14 - IP Block Bypass", "credits": [{"lang": "en", "type": "finder", "value": "William Cooke"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "webfactory", "product": "Login Lockdown & Protection", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.14"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T15:27:33.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=3389843%40login-lockdown&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-330", "description": "CWE-330 Use of Insufficiently Random Values"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:26.978Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11707", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:26.978Z", "dateReserved": "2025-10-13T19:44:59.728Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:30.625Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Login Lockdown & Protection", "vendor": "webfactory", "versions": [{"lessThanOrEqual": "2.14", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts."}, {"lang": "es", "value": "El plugin Login Lockdown & Protection para WordPress es vulnerable a la Omisi\u00f3n de Bloqueo de IP en todas las versiones hasta la 2.14, inclusive. Esto se debe a que la clave $unblock_key es insuficientemente aleatoria, lo que permite a usuarios no autenticados, con acceso al correo electr\u00f3nico de un usuario administrativo, generar claves de desbloqueo v\u00e1lidas para su direcci\u00f3n IP. Esto hace posible que atacantes no autenticados omitan los bloqueos debido a intentos de inicio de sesi\u00f3n no v\u00e1lidos."}], "id": "CVE-2025-11707", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11707", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:25:00.484125Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:45.597", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/login-lockdown/trunk/libs/functions.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3389843%40login-lockdown&new=3389843%40login-lockdown&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9c732ea2-0263-4b18-9aa4-29e387b26362?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:14:43.205536+00:00", "value": {"mitigation_remediation": ["Update the Login Lockdown & Protection plugin to the latest release that fixes the IP block bypass flaw", "If an update is not immediately available, temporarily disable the IP blocking feature or deactivate the plugin until a patched version can be installed", "Monitor login logs for repeated failed attempts from the same IP and consider enforcing additional controls such as a firewall or multi\u2011factor authentication"], "summary": {"action": "Patch", "impact": "IP Block Bypass"}, "threat_synthesis": {"affected_systems": "Vulnerable versions include every released build of the Login Lockdown & Protection plugin through version 2.14. The plugin is developed by webfactory and distributed as a WordPress plugin. End\u2011users running the affected plugin version on their WordPress installation are at risk. No additional operating system or database versions are specified; the issue is confined to the WordPress plugin code itself.", "description_and_impact": "The Login Lockdown & Protection plugin for WordPress contains an IP block bypass vulnerability in all versions up to 2.14. The flaw originates from the $unblock_key token being insufficiently random, enabling an unauthenticated attacker who knows a legitimate administrative email address to compute a valid unblock key for any IP. By issuing such a key, the attacker can prevent the plugin from blocking the IP after excessive failed login attempts, effectively circumventing the brute\u2011force mitigation. The immediate effect is that blocks intended to limit attackers are rendered ineffective, which can prolong brute\u2011force attacks or allow continued access attempts despite blocking logic.", "risk_and_exploitability": "The CVSS score of 5.3 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA's KEV catalog. Attackers must first obtain an administrative user email address, which is typically available via publicly exposed email accounts or through other social engineering. Once an email is known, the attacker can compute an unblock key and supply it to the plugin, bypassing the IP block. No local privileges or authentication are required, and the impact is limited to disabling IP\u2011based blocking rather than enabling further code execution."}}}}, "created": "2025-12-14T21:14:54.766440+00:00", "updated": "2026-04-22T12:15:16.040130+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}