¿Es seguro Loginizer?

Qué hace este plugin

• Slug: loginizer
• 1000000+ instalaciones activas

accessadminloginLoginizersecurity

Estado de mantenimiento

• Última versión conocida: 2.0.8
• Requiere PHP: 5.5+
• PHP máximo soportado (analizado): <8.0

Vulnerabilidades conocidas

8 CVEs conocidos registrados para Loginizer. Reportadas entre 2017 y 2024.

CVE-2024-10097

The Loginizer Security and Loginizer plugins for WordPress are vulnerable to authentication bypass in all versions up to, and including, 1.9.2. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2023-2296

Update the WordPress Loginizer plugin to the latest available version (at least 1.7.9). Erwan LR (WPScan) discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Loginizer Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.7.9.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-45079

The Loginizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.5. This is due to missing or incorrect nonce validation on the loginizer_backuply_promo() function. This makes it possible for unauthenticated attackers to install the backuply plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-45084

The Loginizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘name’ parameter in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2020-27615

The Loginizer WordPress plugin was found to be affected by an Unauthenticated SQL Injection vulnerability found by the security researcher mslavco. The vulnerability was triggered within the brute force protection functionality, which was enabled by default when the plugin was first installed. When a user attempts to login with an unknown username, the attempt is logged in the backend database, where the username, as well as other parameters, are not properly validated before being placed within the SQL query. The patch for this issue also included other input sanitisation checks to prevent Cross-Site Scripting (XSS) vulnerabilities. WordPress issued a forced update to patch this vulnerability. According to the plugin author, this resulted in 89% of sites with the plugin being successfully patched.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Loginizer [loginizer] < 1.6.4

Unauthenticated SQL Injection (SQLi) vulnerability found by Slavco Mihajloski (mslavco) in WordPress Loginizer plugin (versions <= 1.6.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2018-11366

Versions 1.3.8 to 1.3.9 the Loginizer WordPress Plugin were found to be vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability was due to the Plugin’s logging functionality using the $_SERVER['REQUEST_URI'] PHP variable to create a URL string that was logged to the database without any input validation. The URL that was saved to the database was later output within HTML without any output encoding. An unauthenticated attacker could inject malicious JavaScript into the Loginizer - Brute Force Settings page where attempted brute force logs are displayed. When an administrative user visits the page, the JavaScript would be executed, which could allow an unauthenticated attacker to entirely compromise the WordPress application.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

CVE-2017-12650

Blind SQL Injection vulnerability found by Jonas Lejon (WPScans) in WordPress Loginizer plugin version 1.3.5 and earlier versions. Vulnerable due to http-header forwarding without any sanitization to lz_selectquery() and then $wpdb->get_results(). Update the WordPress Loginizer plugin to the latest available version (at least 1.3.6).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

+ 3 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2017-12651	Loginizer [loginizer] < 1.3.6	Falsificación de petición en sitios cruzados (CSRF)	Alta 8,8	< 1.3.6	1.3.6	2017-08-07	✓ corregido en la última versión
—	Loginizer [loginizer] < 1.7.6	—	Desconocido	< 1.7.6	1.7.6	—	✓ corregido en la última versión
—	Loginizer [loginizer] < 1.7.6	—	Desconocido	< 1.7.6	1.7.6	—	✓ corregido en la última versión

CVE-2017-12651

Cross-Site Request Forgery (CSRF) vulnerability found by Jonas Lejon (WPScans) in WordPress Loginizer plugin version 1.3.5 and earlier versions. The vulnerability exists in the init.php file of the "Blacklist and Whitelist IP Wizard." Update the WordPress Loginizer plugin to the latest available version (at least 1.3.6).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Loginizer [loginizer] < 1.7.6

Update the WordPress Loginizer plugin to the latest available version (at least 1.7.6). Yeraisci discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Loginizer Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 1.7.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Loginizer [loginizer] < 1.7.6

Update the WordPress Loginizer plugin to the latest available version (at least 1.7.6). Yeraisci discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Loginizer Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. For example a password change which will then allow the malicious actor to login into the admin account. This vulnerability has been fixed in version 1.7.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Cómo solucionarlo

Mantén Loginizer actualizado — 2.0.8 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WPS Hide Login — 2000000+ instalaciones activas — 96/100 (2109) — PHP máx. 8.4
• Security Optimizer – The All-In-One Protection Plugin — 1000000+ instalaciones activas — 90/100 (155) — PHP máx. <8.0
• User Role Editor — 700000+ instalaciones activas — 90/100 (287) — PHP máx. 8.4
• Members – Membership & User Role Editor Plugin — 300000+ instalaciones activas — 98/100 (1263)
• Limit Login Attempts — 300000+ instalaciones activas — 92/100 (202) — PHP máx. 8.4