WP Manifestindependent plugin directory
manifest / security / wp-login-attempts-logger

Login Attempts Logger WP RegistryLow-severity findings · 1 findingOpen the reportA-

A Wordpress plugin for logging login attempts.

by Patrick Stecker · github.com/patrickstecker/wp-login-attempts-logger · website

★ 0stars
11release downloads
v1.3.0latest · 3 years ago

Install

Download login-attempts-logger.v1.1.zip From the v1.1 release on GitHub, Mar 6, 2023

Upload it under Plugins → Add New Plugin → Upload Plugin, then activate.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/patrickstecker/wp-login-attempts-logger/releases/download/v1.1/login-attempts-logger.v1.1.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/patrickstecker/wp-login-attempts-logger ↗

Wordpress Login Attempts Logger

This Wordpress Plugin logs all login attempts and displays it on a settings page. It is secured against several potential attacks like SQL injections, XSS attacks, File inclusion attacks, brute force attacks, ...

How to install

  1. Download the latest release as a ZIP file.
  2. Log into your wordpress site with your admin user and go to Plugins -> add New and click the button Upload Plugin.
  3. On this page, select the ZIP file you downloaded in step 1 and follow through the installation progress.
  4. When the installation was successful, don't forget to activate the plugin.

How to use

After you have installed and activated the plugin, it starts to log all login requests. It doesn't show log ins that happened before the plugin was activated.
To see the login attempts follow these steps:

  1. Log into your wordpress site with your admin user
  2. In your site's backend, navigate to Settings -> Login Attempts
  3. On this page you can see all login attempts since the plugin was activated. It should simular to this:
    login attempts sample page

Releases

5 releases. Each count is every asset in that release; expand a row for the breakdown.

Tag
Published
Assets
Downloads
v1.3.0 latest
Mar 15, 2023 3 years ago
tag only
—
v1.2.0
Mar 10, 2023 3 years ago
tag only
—
v1.1.2
Mar 10, 2023 3 years ago
tag only
—
v1.1.1
Mar 7, 2023 3 years ago
tag only
—
v1.1
Mar 6, 2023 3 years ago
login-attempts-logger.v1.1.zip
11
A- grade

Security

Login Attempts Logger 1.1 · audited by WP Registry

Low-severity findings only.

1 low
Audited release
1.1
Findings
1
Worst severity
low
Content hash
b2f07c9513708ed8e433059d…

Findings

  • low Deactivation drops wrong table name and leaves real login_attempts table

    debug_code

    Activation creates {$wpdb->prefix}login_attempts. Deactivation drops {$wpdb->prefix}my_plugin_login_attempts and deletes unrelated my_plugin_option* keys. The real log table and data remain forever; the wrong DROP is harmless but shows unfinished scaffolding. Not remotely exploitable.

    login-attempts-logger.php:118-129

    Recommendation

    Drop the actual login_attempts table on uninstall; remove placeholder option deletes.

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.

Full report on WP Registry →