→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-97308 · login-lockdown

دور زدن محدودیت‌های امنیتی (Security Bypass) در افزونه Login Lockdown & Protection

The Login Lockdown & Protection plugin for WordPress is vulnerable to Bypass Vulnerability in all versions up to, and including, 2.17. This is due to the is_rest_request() function trusting the user-supplied $_GET['rest_route'] parameter to determine whether a request is a REST API call, allowing any unauthenticated request to masquerade as a REST request and skip lockout enforcement. This makes it possible for unauthenticated attackers to bypass the login lockout protection entirely by supplying a crafted `rest_route` GET parameter, allowing unlimited login attempts regardless of configured lockout thresholds.