What’s Vulnerable › Vulnerabilities

CVE-2022-0787: Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-03-28 · updated 2026-06-17
• Weakness: CWE-89

Description

The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections

Affected products

• Limit Login Attempts: before 5.1 — fixed in 5.1

How to fix

Upgrade to a fixed version: Limit Login Attempts 5.1. Check the vendor advisory for mitigations.

References

• https://wpscan.com/vulnerability/69329a8a-2cbe-4f99-a367-b152bd85b3dd
• https://wpscan.com/vulnerability/69329a8a-2cbe-4f99-a367-b152bd85b3dd

Get alerted when CVE-2022-0787 or the next vulnerability affects your stack