CVE-2025-3766
Last modified
CVE-2025-3766 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. EPSS estimates a 0.29% chance of exploitation in the next 30 days.
Description
The Login Lockdown & Protection plugin for WordPress is vulnerable to unauthorized nonce access due to a missing capability check on the ajax_run_tool function in all versions up to, and including, 2.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a valid nonce that can be used to generate a global unlock key, which can in turn be used to add arbitrary IP address to the plugin allowlist. This can only by exploited on new installations where the site administrator hasn't visited the loginlockdown page yet.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-3766?
How severe is CVE-2025-3766?
How do I fix CVE-2025-3766?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-3760A stored cross-site scripting (XSS) vulnerability exists wit…5.4
- CVE-2025-3761The My Tickets – Accessible Event Ticketing plugin for WordP…8.8
- CVE-2025-3762A vulnerability was found in PCMan FTP Server 2.0.7. It has …9.8
- CVE-2025-3763A vulnerability classified as critical has been found in Sou…7.8
- CVE-2025-3764A vulnerability classified as critical was found in SourceCo…8.8
- CVE-2025-3765A vulnerability, which was classified as critical, has been …8.8
- CVE-2025-3767Improper Neutralization of Special Elements used in an SQL C…7.2
- CVE-2025-3768Improper access control in Tor network blocking feature in D…5
- CVE-2025-3769The LatePoint – Calendar Booking Plugin for Appointments and…5.3
- CVE-2025-3770EDK2 contains a vulnerability in BIOS where an attacker may …7
- CVE-2025-3771A path or symbolic link manipulation vulnerability in SIR 1.…7.1
- CVE-2025-37727Insertion of sensitive information in log file in Elasticsea…5.7
Are you affected by CVE-2025-3766?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST