CVE-2020-27615: Loginizer WordPress plugin SQL injection in login failure handling

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, a public exploit reference, and a very high EPSS percentile make this an urgent patch.

What it is

The Loginizer plugin for WordPress before 1.6.4 is vulnerable to SQL injection through the loginizer_login_failed and lz_valid_ip parameters, with resulting cross-site scripting. Because the flaw is reachable without authentication and can be triggered through normal login handling, it exposes a large number of WordPress sites running the affected plugin.

Impact

An unauthenticated attacker can inject SQL to read or alter database contents, and the resulting XSS can execute script in a victim's browser. Full compromise of confidentiality, integrity and availability is possible given the critical CVSS rating.

Attack surface

The vulnerability is network reachable via HTTP requests to the WordPress login flow, specifically the loginizer_login_failed and lz_valid_ip inputs. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Not listed in CISA KEV, but EPSS is high at 0.523 (98.9th percentile) and a public exploit reference exists, indicating meaningful real-world exploitation risk.

What to do

• Update the Loginizer plugin to version 1.6.4 or later immediately; WordPress also pushed a forced security update for this bug.
• If patching cannot be done at once, disable or remove the Loginizer plugin until it can be updated.
• Review WordPress user accounts and database contents for signs of tampering after exposure.
• Restrict or monitor access to wp-login.php and related login endpoints at the WAF or reverse proxy layer.
• Keep WordPress core, themes and all plugins current to reduce similar exposure.

Detection

• Inspect web server and WAF logs for SQL injection patterns in requests to wp-login.php and Loginizer-related parameters such as loginizer_login_failed and lz_valid_ip.
• Monitor for unexpected database errors or anomalous queries originating from the WordPress application.
• Look for injected script content or unexpected changes in WordPress pages and options that could indicate XSS or database tampering.
• Alert on Loginizer plugin versions below 1.6.4 across managed WordPress instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.