Disable User Login
Disable User Login has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for Disable User Login has a vendor fix available, so running the current release closes it.
All of these findings were reported by qilin_99. Disable User Login is installed on roughly 6,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2023-47806Disable User Login <= 1.3.8 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

Disable User Login
Author
Saint Systems
This plugin gives you the ability to disable specific user accounts via a profile setting. Once installed and activated, a checkbox appears on the user profile settings (only for admins). When checked, the user’s account will be disabled and they will be unable to login with the account. If they try to login, they are instantly logged out and redirected to the login page with a message that notifies them their account is disabled. This can be useful in a few situations. You want freelance writers to still show up in the authors box, but you don’t want them to be able to login. You have former employees who have authored posts and you don’t want to delete them or reassign their posts to other users, but still need them to show up in the “Authors box.” You are working on a site for a client who has an account, but do not want him to login and/or make changes during development. You have a client who has an unpaid invoice. This plugin is on GitHub! Pull requests are welcome. If possible please report issues through Github. Upgrade to Pro Disable User Login Pro adds powerful tools for managing user accounts at scale: CSV Import & Export — bulk enable or disable hundreds of users at once via spreadsheet Email Notifications — automatically notify users when their account is disabled or re-enabled, with customizable email templates, merge tags, and optional admin CC Audit Log — full history of every disable/enable action with timestamps, who performed it, and why Filterable User List — “Disabled” and “Enabled” filter views on the Users screen with count badges and a sortable Disabled column Perfect for membership sites, nonprofits managing volunteers, agencies onboarding/offboarding clients, and universities managing student accounts. Learn more about Disable User Login Pro
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C