CVE-2026-118201 in Limit Login Attempts Security Plugin
Summary
by MITRE • 11/09/2026
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/09/2026
The Limit Login Attempts Security plugin for WordPress is designed to mitigate brute-force attacks by restricting the number of failed authentication attempts from specific IP addresses or users. A critical security flaw exists in versions prior to 3.4.1 where the enforcement of two-factor authentication (2FA) is incomplete across all entry points into the system. Specifically, while the primary login interface correctly requires both a valid password and a second factor for verification, alternative administrative routes or legacy endpoints within the WordPress ecosystem do not trigger this additional security layer. This architectural inconsistency creates a significant bypass vector that undermines the intended protection model of the plugin.
From a technical perspective, the vulnerability stems from an incomplete implementation of access control checks on specific authentication handlers. When a user attempts to log in through standard channels, the application correctly validates credentials and then prompts for or verifies the second factor token. However, other routes such as XML-RPC endpoints, REST API login methods, or custom admin-ajax actions may bypass this logic entirely if they rely solely on session cookies or basic credential validation without invoking the 2FA middleware. An attacker who has obtained a user's password through phishing, data breaches, or keylogging can exploit these alternative paths to authenticate directly into the WordPress dashboard. Since the second factor is not required for these specific routes, the attacker gains full administrative access despite the presence of two-factor authentication on other interfaces.
The operational impact of this vulnerability is severe, particularly for websites that rely heavily on 2FA as their primary defense against credential stuffing and brute-force attacks. By bypassing the second factor, an attacker can assume the identity of any user whose password has been compromised. This leads to unauthorized access to sensitive site data, potential defacement, installation of malicious plugins or themes, and further lateral movement within the network if the WordPress instance is connected to other systems. The vulnerability effectively nullifies the security benefit provided by 2FA for users who are targeted via these alternative authentication vectors, creating a false sense of security among administrators who believe their accounts are fully protected against password-based attacks.
This flaw aligns with CWE-306, which describes Missing Authentication for Critical Function, as the application fails to enforce required authentication mechanisms on specific functional endpoints. It also relates to CWE-287, Improper Authentication, because the system accepts credentials without verifying all necessary factors of identity. In terms of MITRE ATT&CK tactics, this vulnerability facilitates Initial Access through Valid Accounts and potentially Credential Access if combined with other techniques like phishing or brute force against the primary login page followed by exploitation of this bypass for lateral movement within the application context.
To mitigate this risk, administrators must immediately upgrade the Limit Login Attempts Security plugin to version 3.4.1 or later, where these authentication checks have been corrected to apply uniformly across all relevant routes. Until an update is applied, it is advisable to disable any non-essential login interfaces such as XML-RPC if they are not actively used for legitimate purposes like remote publishing. Additionally, implementing a Web Application Firewall (WAF) with rules that detect and block anomalous authentication patterns can provide a temporary layer of defense. Organizations should also enforce strong password policies and consider deploying 2FA solutions at the infrastructure level or through more robust plugins that ensure comprehensive coverage across all entry points to prevent similar bypasses in the future.