Disable User Login
Disable User Login has one disclosed vulnerability in the WordSec catalog, all reported in 2022; it remains unpatched as of September 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Disable User Login has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2022.
All of these findings were reported by Rafshanzani Suhada. Disable User Login is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2022-2350Disable User Login <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update
Read the full analysisVulnerability Records
Disable User Login
Author
brainvireinfo
The plug-in lists out all the existing users’ accounts and gives the ability to admin to disable specific user accounts via email address. Once installed and activated, this plug-in lists out all the user accounts available. The admin will be asked to enter the email address of the user who they want to restrict from logging in. If the disabled user tries to login, they will be logged out immediately and redirected to the login page with a message showing up as “User account disabled”. How is it Useful? You can restrict another user (who has an account) from making any changes during development. You have a client who has an unpaid invoice. You want to restrict malicious users.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C