CVE-2022-0787: Limit Login Attempts Project Limit Login Attempts

Critical severity, CVSS 9.8. EPSS: 8.6% chance of exploitation in the next 30 days.

The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections

Affected products

• Limit Login Attempts Project Limit Login Attempts: before 5.1 (fixed in 5.1)

Published 2022-03-28. Last modified 2026-06-17.