Vulnerability in Lock User Account Plugin Allows Authenticated Attackers to Bypass Account Lock
CVE-2024-11197

4.2MEDIUM

Key Information:

Vendor

Wordpress
Status
Lock User Account
Vendor
CVE Published:
21 November 2024

What is CVE-2024-11197?

The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Lock User Account * <= 1.0.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wordpress.org/plugins/lock-user-account/

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Francesco Carlucci
JSON
.