- Active installations
- 1 million+
- WordPress.org status
- Active
- Known vulnerabilities
- Several, historically
- Open unresolved
- 0
- Last vulnerability
- None current
- PHP compatibility
- PHP 7.4–8.3 supported
- Maintenance frequency
- Active — regular releases
Data reviewed August 2026. Version numbers move weekly — the WordPress.org listing linked in the sidebar is always authoritative for the current release.
Current security status
Loginizer is actively maintained, listed and open on WordPress.org, and has no known unresolved vulnerabilities. WPDeeply rates it LOW risk for a typical site.
Why this rating
Loginizer carries the most consequential plugin vulnerability of 2020 in its history, and that history is precisely why the rating is not worse. The issue was found, fixed within days, and the ecosystem was patched by an unprecedented WordPress-initiated forced update. The plugin has continued shipping releases since.
Security history
- October 2020 — CVE-2020-27615. Unauthenticated SQL injection in the brute-force protection, reachable from any login page, with resultant stored XSS. Fixed in 1.6.4. WordPress force-updated over a million sites; the author reported roughly 89% patched. Full write-up: Loginizer before 1.6.4 — unauthenticated SQL injection.
- Subsequent releases have addressed smaller hardening issues without a comparable incident.
The lesson worth keeping
A security plugin is still software, and a brute-force logger writes attacker-supplied strings to your database by design. Installing protection does not exempt a plugin from the checks in how to check if a plugin is safe.
Recommendation
Keep it, keep it updated, and do not treat it as a substitute for two-factor authentication. Login rate limiting reduces noise; 2FA is what actually stops credential stuffing.