# CVE-2026-97308: Login Lockdown authentication bypass

Source: https://junglewise.ai/threats/cve-2026-97308-unauthenticated-bypass-vulnerability-in-login-lockdown-2-17  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-97308 · Severity: medium · CVSS 4.8 · Published 2026-10-06

Login Lockdown is a WordPress plugin that protects user accounts by limiting failed login attempts. A security bypass in versions up to 2.17 allows attackers to circumvent these protections without authentication, potentially enabling brute-force password attacks and unauthorized account access.

Vendors: [WebFactory Ltd](https://junglewise.ai/threats/vendors/webfactory-ltd).

## Quick answers

**Is CVE-2026-97308 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-97308 being exploited in the wild.

**How severe is CVE-2026-97308?** Medium severity, with a CVSS score of 4.8, published 6 October 2026.

**Which products and versions are affected?** WebFactory Ltd Login Lockdown <= 2.17.

**Is there a fix for CVE-2026-97308?** Yes: fixed in 2.18. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-97308 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-97308?** Check whether you run WebFactory Ltd Login Lockdown at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.18

## Technical details

The vulnerability is an authentication bypass in the Login Lockdown WordPress plugin affecting versions up to 2.17. It allows unauthenticated attackers to bypass the login rate-limiting protections the plugin is designed to enforce, classified as an insecure design issue. The bypass could be exploited to facilitate credential brute-force attacks against protected WordPress sites.

## Affected products

- WebFactory Ltd. Login Lockdown <= 2.17

## Timeline

- 2026-10-05: disclosed
- 2026-10-06: advisory

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/login-lockdown/vulnerability/wordpress-login-lockdown-plugin-2-17-bypass-vulnerability-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/login-lockdown/vulnerability/wordpress-login-lockdown-plugin-2-17-bypass-vulnerability-vulnerability?_s_id=cve)