CVE-2026-118202 in Limit Login Attempts Security Plugin
Summary
by MITRE • 11/09/2026
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/09/2026
The Limit Login Attempts Security plugin for WordPress contains a critical logic flaw in its two-factor authentication implementation prior to version 3.4.1. This vulnerability stems from an improper verification of multi-factor authentication states during the login process. Specifically, the application fails to validate that the second factor has been successfully completed before granting access to the user account. Instead of requiring explicit confirmation of a successful two-factor challenge, the code treats any failure in building or processing this step as equivalent to success. This design error effectively nullifies the security benefit provided by the additional authentication layer, reducing it to a non-functional component that does not enforce its intended policy.
From a technical perspective, an attacker can exploit this flaw by manipulating HTTP request headers during the login sequence. By sending a specifically crafted header or payload that causes the two-factor authentication step to fail internally without triggering an error response, the application proceeds with the login process as if the second factor had been passed. This bypass allows unauthorized access to any user account for which the attacker possesses the primary password credentials. The vulnerability is particularly dangerous because it does not require complex exploitation techniques or remote code execution; it relies solely on a logical misconfiguration in how authentication states are evaluated and persisted during the session establishment phase.
The operational impact of this vulnerability is severe, as it compromises the integrity of multi-factor authentication systems designed to protect sensitive WordPress installations. Since many organizations rely on two-factor authentication to mitigate risks associated with credential theft, such as phishing or brute-force attacks, bypassing this layer exposes user accounts to unauthorized access even if strong passwords are in use. This flaw aligns with CWE-287, which describes Improper Authentication, and specifically relates to the failure to verify multi-factor credentials correctly. In terms of attack patterns, it corresponds to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials but bypasses additional security controls to gain unauthorized access.
To mitigate this vulnerability, administrators must immediately update the Limit Login Attempts Security plugin to version 3.4.1 or later, where the logic error has been corrected to properly enforce two-factor authentication completion before granting session tokens. Additionally, organizations should review their WordPress configurations to ensure that no legacy versions of security plugins remain in use. It is also advisable to implement network-level monitoring for unusual login patterns and consider deploying a Web Application Firewall to detect and block requests exhibiting characteristics of this header manipulation attack vector until the patch can be applied.