William Cooke

**Name of the Vulnerable Software and Affected Versions** Login Lockdown & Protection plugin for WordPress versions up to and including 2.14 **Description** The Login Lockdown & Protection plugin for WordPress is susceptible to an IP block bypass. This occurs because the `$unblock key` key is not sufficiently random. Unauthenticated users who have access to an administrative user email can generate valid unblock keys for their IP address. This allows attackers to circumvent IP address blocks implemented to prevent brute-force login attempts. **Recommendations** Update the Login Lockdown & Protection plugin to a version later than 2.14.