WordPress Plugin Vulnerabilities
Login Lockdown & Protection < 2.18 - Unauthenticated Login Lockout Bypass
Description
The is_rest_request() function trusts the user-supplied rest_route GET parameter to determine whether a request is a REST API call, allowing any unauthenticated request to masquerade as a REST request and skip lockout enforcement. This makes it possible for unauthenticated attackers to bypass the login lockout protection entirely by supplying a crafted rest_route GET parameter, allowing unlimited login attempts regardless of the configured lockout thresholds.
Affects Plugins
Fixed in 2.18 References
Miscellaneous
Original Researcher
Ananda Dhakal
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-10-05 (about 12 days ago)
Added
2026-10-10 (about 7 days ago)
Last Updated
2026-10-10 (about 7 days ago)
