CVE-2026-118202
Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.
| Vendor | unknown |
| Product | limit login attempts security |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown limit login attempts security
Be the first to know when new high vulnerabilities affecting unknown limit login attempts security are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Limit Login Attempts Security
0 < 3.4.1
References
Credits
Naoki Kawahigashi WPScan