Input validation vulnerability in Login Lockdown – Protect Login Form 2.07

The Login Lockdown – Protect Login Form plugin for WordPress has a security vulnerability that makes it possible for malicious users, with administrator access, to access sensitive information from the database. This security flaw exists in all versions of the plugin up to 2.07. The vulnerability is caused by the user supplied parameter ‘iDisplayStart’ not being escaped properly and the lack of sufficient preparation on the existing SQL query.