The vulnerability identified as CVE-2024-1340 affects the WordPress plugin 'Login Lockdown – Protect Login Form' developed by webfactory. This plugin is designed to enhance login security by restricting access based on IP whitelisting and locking down login attempts. The flaw lies in the generate_export_file function, which lacks proper authorization checks (CWE-862: Missing Authorization). Consequently, any authenticated user with at least subscriber privileges can invoke this function to export the plugin's configuration data. Exported data includes sensitive information such as the list of whitelisted IP addresses and a global unlock key. Possession of the global unlock key enables an attacker to add their own IP address to the whitelist, effectively circumventing login restrictions and potentially gaining persistent unauthorized access. The vulnerability affects all plugin versions up to and including 2.08. The CVSS 3.1 base score is 5.4 (medium), reflecting that exploitation requires network access and authenticated privileges but no user interaction, and results in limited confidentiality and integrity impact without affecting availability. No public exploits have been reported yet, but the vulnerability presents a significant risk in environments where subscriber-level accounts are easily obtainable or compromised. The absence of patch links suggests that a fix may not yet be available, emphasizing the need for immediate mitigation steps.

This vulnerability allows attackers with low-level authenticated access to escalate their privileges indirectly by exporting sensitive plugin settings and manipulating the IP whitelist. The impact includes unauthorized bypass of login restrictions, which can lead to further unauthorized access to the WordPress admin panel or other protected resources. Confidentiality is impacted as sensitive configuration data is exposed, and integrity is affected because attackers can alter whitelist entries. Although availability is not directly impacted, the breach of login controls can facilitate subsequent attacks such as brute force, data theft, or site defacement. Organizations relying on this plugin for login security may face increased risk of account compromise, especially if subscriber accounts are not tightly controlled. This can affect website integrity, user trust, and potentially lead to broader network compromise if the WordPress site is part of a larger infrastructure.

1. Immediately restrict subscriber and low-privilege user access to trusted individuals only until a patch is available. 2. Monitor and audit user activities, especially export operations related to the plugin. 3. If feasible, temporarily disable or uninstall the 'Login Lockdown – Protect Login Form' plugin until an official patch is released. 4. Implement additional access controls at the web server or firewall level to limit access to the WordPress admin area. 5. Use strong, unique credentials and enforce multi-factor authentication (MFA) for all authenticated users to reduce the risk of account compromise. 6. Regularly review and update IP whitelists manually to detect unauthorized additions. 7. Stay informed on vendor updates and apply patches promptly once available. 8. Consider alternative plugins with verified secure authorization checks for login protection if patching is delayed.