Disable User Login

Disable User Login has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).

The one issue recorded for Disable User Login has a vendor fix available, so running the current release closes it.

All of these findings were reported by qilin_99. Disable User Login is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium
4.3/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all Disable User Login vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.3CVE-2023-47806

Disable User Login <= 1.3.8 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

1 records
Showing 1–1 of 1 reports
Disable User Login banner
Latestv2.1.7

Disable User Login

Saint Systems

Author

Saint Systems

5.0(6)
100/100
Last Updated
2026-04-03 (5mo ago)
Active Installs
6,000+
Downloads
72,153
Requires WP
6.2+
Requires PHP
7.4+
Tested up to
WP 6.9.7
Created
2019-08-13 (7y ago)

This plugin gives you the ability to disable specific user accounts via a profile setting. Once installed and activated, a checkbox appears on the user profile settings (only for admins). When checked, the user’s account will be disabled and they will be unable to login with the account. If they try to login, they are instantly logged out and redirected to the login page with a message that notifies them their account is disabled. This can be useful in a few situations. You want freelance writers to still show up in the authors box, but you don’t want them to be able to login. You have former employees who have authored posts and you don’t want to delete them or reassign their posts to other users, but still need them to show up in the “Authors box.” You are working on a site for a client who has an account, but do not want him to login and/or make changes during development. You have a client who has an unpaid invoice. This plugin is on GitHub! Pull requests are welcome. If possible please report issues through Github. Upgrade to Pro Disable User Login Pro adds powerful tools for managing user accounts at scale: CSV Import & Export — bulk enable or disable hundreds of users at once via spreadsheet Email Notifications — automatically notify users when their account is disabled or re-enabled, with customizable email templates, merge tags, and optional admin CC Audit Log — full history of every disable/enable action with timestamps, who performed it, and why Filterable User List — “Disabled” and “Enabled” filter views on the Users screen with count badges and a sortable Disabled column Perfect for membership sites, nonprofits managing volunteers, agencies onboarding/offboarding clients, and universities managing student accounts. Learn more about Disable User Login Pro

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C