Known vulnerabilities in Limit Login Attempts (Spam Protection)

Limit rate of login attempts, including by way of cookies, for each IP. Fully customizable.

5Reported vulnerabilities

9.8Highest CVSS score

5.6Latest version

200+Active installs

What to do now

Update Limit Login Attempts (Spam Protection) to 5.6 or later. 5 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 15, 2025 / Tested up to WordPress: 6.8.8 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-0787	Critical 9.8	7.5%	Before 5.1	`5.1`	March 28, 2022
CVE-2021-24194	High 8.8	1.3%	Before 2.9	`2.9`	May 14, 2021
WF-7d525c50-5911-4be6-a860-b48db619adba	High 8.8	—	2.9 and earlier	`3.1`	April 22, 2021
CVE-2024-54234	High 7.5	0.5%	5.5 and earlier	`5.6`	December 5, 2024
CVE-2022-4534	Medium 5.3	0.3%	0 to 5.3 (inclusive) 0 to 5.3 (inclusive)	`5.4`	October 8, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.