Description
The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Limit Login Attempts Reloaded | < 2.25.26 | 2.25.26 |
References
- https://wpscan.com/vulnerability/654bad15-1c88-446a-b28b-5a412cc0399d exploit vdb-entry technical-description