CVE-2025-11707

5.3 Medium

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.45%Up 0.4 points since Dec 13, 2025

What each source reports

CVE List Score used 5.3

Login Lockdown & Protection <= 2.14 - IP Block Bypass

Record: CVE-2025-11707
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-330
Updated: 2026-11-02

EUVDEUVD-2025-203209 5.3

Record: EUVD-2025-203209
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-95hc-3vwp-3cjf 5.3

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all...

Record: GHSA-95hc-3vwp-3cjf
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-330
Updated: 2026-11-02

NVD 5.3

Record: CVE-2025-11707
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-330
Updated: 2026-11-02

Affected products

webfactory login lockdown & protection

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-11707 is a medium vulnerability (CVSS 5.3) in Webfactory Login Lockdown & Protection, published December 13, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. No source names a fixed version.