CVE-2012-10001: 
WordPress vulnerability analysis and mitigation

The Limit Login Attempts plugin before version 1.7.1 for WordPress contains a security vulnerability identified as CVE-2012-10001. The vulnerability was discovered and disclosed on January 6, 2021. The issue affects the authentication mechanism where the plugin fails to clear authentication cookies upon a lockout, potentially enabling remote attackers to conduct brute-force authentication attempts (NVD, CVE).

The vulnerability stems from a change introduced in version 1.6.2 that broke the authentication cookie clearing functionality during lockouts. While normal password login attempt lockouts functioned correctly, the failure to clear auth cookies allowed attackers to continue attempting to break these cookies during a lockout period. The auth cookies contain cryptographic hashes of user passwords, which theoretically should be resistant to brute force attacks due to the cryptographic operations used and hash value length (WPScan). The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow remote attackers to perform continuous brute-force attempts against authentication cookies even during lockout periods. While the auth cookies are designed to be resistant to brute-force attacks due to their cryptographic nature, the persistence of these cookies during lockouts undermines the plugin's security measures (WPScan).

The vulnerability requires no special privileges or user interaction to exploit. An attacker can remotely attempt to break the authentication cookies during lockout periods, though the theoretical difficulty of breaking the cryptographic hash makes successful exploitation challenging (NVD).

The vulnerability has been fixed in version 1.7.1 of the Limit Login Attempts plugin. Users should upgrade to this version or later to ensure proper clearing of authentication cookies during lockout periods (WordPress Plugin).