CVE-2024-11197 is a protection mechanism failure (CWE-693) in the babatechs Lock User Account WordPress plugin. The vulnerability allows authenticated users who possess valid application passwords to bypass the account lock feature by authenticating through APIs such as XML-RPC or REST. This undermines the intended lockout mechanism, enabling continued interaction with the site despite the user account being locked. The issue affects all versions up to and including 1.0.5. The CVSS 3.1 base score is 4.2, reflecting a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality and integrity impact.

Authenticated attackers with existing application passwords can bypass the user account lock and interact with the site via API endpoints. This could lead to unauthorized access to user-specific functionality or data despite the account being locked. The impact is limited to confidentiality and integrity with no availability impact reported. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling application password logins or restricting API access for locked accounts as a temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.