{"id":"CVE-2026-118201","kind":"vulnerability","aliases":["CVE-2026-118201"],"related":[],"title":"Limit Login Attempts WordPress plugin: two-factor login bypassed via alternate login route","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce two-factor authentication on every password login route. An attacker who already knows a protected user's password can sign in through an alternative login interface and get that user's access without the second factor.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["limit-login-attempts","package","self-hosted","wordpress"],"not_affected_if":["no-two-factor-enabled","plugin-version-3.4.1-or-later"],"how_to_check":"- Check the installed version of the Limit Login Attempts Security plugin in the WordPress admin under Plugins; versions before `3.4.1` are affected.","fix":null,"status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:48+00:00","updated_at":"2026-11-09T07:25:48+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:48Z","model":"claude-haiku-5-5","output":{"fix":"- Limit Login Attempts Security plugin: move to `3.4.1` or later.","reach":"internet","title":"Limit Login Attempts WordPress plugin: two-factor login bypassed via alternate login route","impact":"high","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce two-factor authentication on every password login route. An attacker who already knows a protected user's password can sign in through an alternative login interface and get that user's access without the second factor.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","limit-login-attempts","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker logs in as a protected user without the second factor","analyst_note":"","how_to_check":"- Check the installed version of the Limit Login Attempts Security plugin in the WordPress admin under Plugins; versions before `3.4.1` are affected.\n- Unknown whether other login routes exist on a given site; the sources do not say which.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-3.4.1-or-later","no-two-factor-enabled"],"who_is_affected":"Sites running the Limit Login Attempts Security WordPress plugin before `3.4.1` where two-factor authentication is enabled for users. An attacker needs the user's password, so the risk is credential theft or reuse rather than an open login bypass. Sites without this plugin or already on `3.4.1` or later are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4544,"output_tokens":571,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118201':17A,20A '-2026':16A,19A '3.4.1':38B,87C 'access':74B,125C 'alreadi':54B,106C 'altern':12A,66B,117C 'attack':52B,104C 'attempt':3A,24B,33B,82C 'authent':45B,95C,100C,114C 'bypass':10A 'complet':127C 'cve':15A,18A 'enforc':41B,90C 'everi':47B,97C 'factor':8A,44B,78B,94C,130C 'get':70B 'host':28B 'interfac':68B,119C 'know':55B,107C 'limit':1A,22B,31B,80C 'limit-login-attempt':21B 'login':2A,9A,13A,23B,32B,49B,67B,81C,118C 'obtain':121C 'packag':25B 'password':48B,60B,99C,112C 'password-authent':98C 'plugin':5A,36B,85C 'protect':57B,109C 'rout':14A,50B,101C 'second':77B,129C 'secur':34B,83C 'self':27B 'self-host':26B 'sign':62B 'two':7A,43B,93C 'two-factor':6A,42B,92C 'user':58B,72B,110C,123C 'via':11A 'without':75B,126C 'wordpress':4A,29B,35B,84C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Limit Login Attempts Security WordPress plugin before `3.4.1` where two-factor authentication is enabled for users. An attacker needs the user's password, so the risk is credential theft or reuse rather than an open login bypass. Sites without this plugin or already on `3.4.1` or later are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","limitloginattempts","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118201':17A,20A '-2026':16A,19A 'altern':12A 'attempt':3A 'bypass':10A 'cve':15A,18A 'factor':8A 'limit':1A 'login':2A,9A,13A 'plugin':5A 'rout':14A 'two':7A 'two-factor':6A 'via':11A 'wordpress':4A","search_b":"'3.4.1':38B 'access':74B 'alreadi':54B 'altern':66B 'attack':52B 'attempt':24B,33B 'authent':45B 'enforc':41B 'everi':47B 'factor':44B,78B 'get':70B 'host':28B 'interfac':68B 'know':55B 'limit':22B,31B 'limit-login-attempt':21B 'login':23B,32B,49B,67B 'packag':25B 'password':48B,60B 'plugin':36B 'protect':57B 'rout':50B 'second':77B 'secur':34B 'self':27B 'self-host':26B 'sign':62B 'two':43B 'two-factor':42B 'user':58B,72B 'without':75B 'wordpress':29B,35B","search_c":"'3.4.1':87C 'access':125C 'alreadi':106C 'altern':117C 'attack':104C 'attempt':82C 'authent':95C,100C,114C 'complet':127C 'enforc':90C 'everi':97C 'factor':94C,130C 'interfac':119C 'know':107C 'limit':80C 'login':81C,118C 'obtain':121C 'password':99C,112C 'password-authent':98C 'plugin':85C 'protect':109C 'rout':101C 'second':129C 'secur':83C 'two':93C 'two-factor':92C 'user':110C,123C 'without':126C 'wordpress':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118201","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118201","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}