CVE-2024-11197 Lock User Account <= 1.0.5 - User Lock Bypass
Authenticated attackers with application passwords can bypass account locks to access APIs, undermining security controls in the Lock User Account WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-11197?
CVE-2024-11197 is a medium-severity authentication bypass vulnerability in babatechs Lock User Account, published on 21 Nov 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked.
Weakness: CWE-693
Which versions are affected by CVE-2024-11197?
How do I fix CVE-2024-11197?
No fix has been published for CVE-2024-11197 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2024-11197 being exploited?
There is no known exploitation of CVE-2024-11197 in the wild and no public exploit code.