Skip to content
OpenAdvisories
Medium · 4.3 CVE-2024-1861 EUVD-2024-17586GHSA-gpw4-cp4w-g7v7

Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation

Published Feb 28, 2024 · Updated Apr 8, 2026 · Assigned by Wordfence

Description

The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the antihacker_truncate_scan_table() function in all versions up to, and including, 4.52. This makes it possible for authenticated attackers, with subscriber-level access and above, to truncate the scan table.

Affected products

VendorProductAffectedFixed
sminozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan ≤ 4.52 —

References