The Login Lockdown & Protection plugin for WordPress suffers from a missing capability check on the ajax_run_tool function in versions up to 2.11. This flaw permits authenticated users with low privileges (Subscriber-level and above) to retrieve a valid nonce. The nonce can then be leveraged to create a global unlock key, which allows adding arbitrary IP addresses to the plugin's allowlist, potentially bypassing login restrictions. This vulnerability only applies to new installations where the administrator has not visited the plugin's loginlockdown page, limiting the attack window.

An attacker with Subscriber-level access can bypass intended authorization controls to modify the plugin's allowlist by adding arbitrary IP addresses. This could facilitate unauthorized access or bypass of login restrictions enforced by the plugin. The impact is limited to confidentiality and integrity with no availability impact. Exploitation requires authenticated access and is constrained to new installations before administrative interaction with the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should ensure that the loginlockdown page is accessed promptly after installation to close the exploitation window. Restrict Subscriber-level access where possible and monitor for suspicious activity related to plugin allowlist modifications.