The Login Lockdown & Protection WordPress plugin suffers from an IP Block Bypass vulnerability caused by insufficient randomness in the generation of unblock keys ($unblock_key). Attackers with knowledge of an administrative user's email can generate valid unblock keys for their IP address, circumventing blocks triggered by invalid login attempts. This vulnerability affects all versions up to 2.14 and is tracked as CVE-2025-11707 with a CVSS 3.1 base score of 5.3.

An attacker can bypass IP blocking mechanisms designed to prevent brute-force login attempts, potentially allowing repeated unauthorized login attempts without being blocked. The vulnerability does not directly impact confidentiality or availability but can lead to increased risk of unauthorized access attempts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrative email addresses and monitor for suspicious login activity. Avoid relying solely on this plugin's IP blocking feature for brute-force protection.