CVE-2023-5525: Limitloginattempts Limit Login Attempts Reloaded

Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days.

The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing any user with a valid nonce to toggle the auto-update status of the plugin.

Affected products

• Limitloginattempts Limit Login Attempts Reloaded: before 2.25.26 (fixed in 2.25.26)

Published 2023-11-27. Last modified 2026-06-17.