CVE-2026-118201 · Package
NO FIX YET
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce two-factor authentication on every password login route. An attacker who already knows a protected user's password can sign in through an alternative login interface and get that user's access without the second factor.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Limit Login Attempts Security WordPress plugin before 3.4.1 where two-factor authentication is enabled for users. An attacker needs the user's password, so the risk is credential theft or reuse rather than an open login bypass. Sites without this plugin or already on 3.4.1 or later are not affected.
Not affected if no-two-factor-enabled, plugin-version-3.4.1-or-later
Who cares limit-login-attempts, self-hosted, wordpress
3.4.1 are affected.Unknown from the sources.
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.