What is CVE-2025-11707?

CVE-2025-11707 is a medium-severity vulnerability in Webfactory Login Lockdown & Protection, classified under Use of Insufficiently Random Values. CVSS score: 5.3/10. Published 2025-12-13.

How severe is CVE-2025-11707?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Webfactory Login Lockdown & Protection

CVE-2025-11707

The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is due to $unblock_key key being insufficiently random allowing unauthenticated users, with access to an administrative user email, to generate valid unblock keys for their IP Address. This makes it possible for unauthenticated attackers to bypass blocks due to invalid login attempts.

EPSS: 0.004 (34.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Webfactory Login Lockdown & Protection — versions 0

Weakness classification (CWE)

CWE-330 — Use of Insufficiently Random Values

References

Frequently asked questions

What is CVE-2025-11707?: CVE-2025-11707 is a medium-severity vulnerability in Webfactory Login Lockdown & Protection, classified under Use of Insufficiently Random Values. CVSS score: 5.3/10. Published 2025-12-13.
How severe is CVE-2025-11707?: Medium severity. CVSS v3 base score is 5.3 out of 10.