CVE-2022-4533: The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address inform

medium Affects limit-login-attempts-plus (WordPress plugin). Feed 2026.10.29.1, updated 2026-10-28; published 2024-09-19; advisory modified 2026-06-17.

The Limit Login Attempts Plus plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.1.0. This is due to insufficient restrictions on where the IP Address inform

Package: limit-login-attempts-plus (WordPress plugin) WordPress
Affected versions: <=1.1.0
Fixed in: no fix recorded
Severity: medium CVSS 5.3
Exploitation: not on CISA KEV · EPSS 0% (12.3th percentile)
Published: 2024-09-19
Source: nvd

References

CWE-345 CWE-348

NVD record limit-login-attempts-plus (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2019-17228 medium includes/options.php in the motors-car-dealership-classified-listings (aka Motors - Car De same weakness: CWE-345
CVE-2016-9450 high Drupal Incorrect cache context on password reset page same weakness: CWE-345
CVE-2019-8124 medium Magento 2 Community Edition Insufficient Logging same weakness: CWE-345
CVE-2015-8371 high Composer allows cache poisoning from other projects built on the same host same weakness: CWE-345
CVE-2022-4539 medium The Web Application Firewall plugin for WordPress is vulnerable to IP Address Spoofing in same weakness: CWE-345
CVE-2019-8112 high Magento 2 Community Edition Security Bypass same weakness: CWE-345