Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2012-10001: The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
CVE-2012-10001 · published 5 years ago
Summary
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
What to do
- Update limit_login_attempts_project limit_login_attempts to version 1.7.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| limit_login_attempts_project | limit_login_attempts |
< 1.7.1 cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies upon a lockout, which might make it easier for remote attackers to conduct brute-force authentication attempts.
References
- https://wordpress.org/plugins/limit-login-attempts/#developers Release Notes Third Party Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-287Improper Authentication
Timeline
Published6 Jan 2021
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2012-10001 · NVD
Track software like this
Free during beta