CVE-2026-118201
Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.
| Vendor | unknown |
| Product | limit login attempts security |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown limit login attempts security
Be the first to know when new high vulnerabilities affecting unknown limit login attempts security are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Limit Login Attempts Security
3.0.0 < 3.4.1
References
Credits
Qi Qin WPScan