Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
Priority MEDIUM 52CWE-89Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
Why it matters now
EPSS 0.07518 94th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Limit Login Attempts (Spam Protection) (Unknown): 5.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Limit Login Attempts (Spam Protection) | 5.1 to before 5.1 | 5.1 | Patch available | CNA |
- Limit Login Attempts (Spam Protection) VendorUnknown Affected 5.1 to before 5.1 Fixed in 5.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:* | before 5.1 | Vulnerable | Limit Login Attempts Project |
- cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:* Versions before 5.1 Vulnerable ·Limit Login Attempts Project
Remediation
- Fix · CNA Limit Login Attempts (Spam Protection) (Unknown) Fixed in 5.1
Timeline
- 2026-10-02 Threatist record created from CVE-2022-0787
- 2026-10-03 Alias added: GHSA-mv3w-5q88-w6jv
- 2026-10-13 EPSS moved to the 95th–99th percentile
- 2026-10-18 EPSS moved to the 90th–95th percentile
References
More Limit Login Attempts Project Limit Login Attempts vulnerabilities
- TI-2023-01748 Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS CVSS 3.1MEDIUM 5.4
- TI-2012-05424 The Limit Login Attempts plugin before 1.7.1 for WordPress does not clear auth cookies… CVSS 3.1CRITICAL 9.8
- TI-2023-01797 Limit Login Attempts <= 1.7.1 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1HIGH 7.2
- TI-2021-06939 Limit Login Attempts < 4.0.50 - Unauthenticated Stored Cross-Site Scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-0787 · CVE Program
- CVE-2022-0787 · NVD
- FIRST EPSS
- GHSA-mv3w-5q88-w6jv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences