{"id":"CVE-2026-118202","kind":"vulnerability","aliases":["CVE-2026-118202"],"related":[],"title":"WordPress Limit Login Attempts plugin: two-factor step can be bypassed","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm its two-factor authentication step succeeded before completing a login. An attacker who knows a protected user's password can skip the second factor by sending a crafted request header.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","two-factor-auth","wordpress"],"not_affected_if":["plugin-at-3.4.1-or-later","two-factor-not-enabled"],"how_to_check":"- Check the installed version of the Limit Login Attempts Security plugin in the WordPress admin under Plugins; affected if below `3.4.1`.\n- Confirm whether two-factor authentication is enabled for user accounts through the plugin.","fix":null,"status":"open","published_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:46+00:00","updated_at":"2026-11-09T07:25:46+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-09T07:25:46Z","model":"claude-haiku-5-5","output":{"fix":"- Limit Login Attempts Security WordPress plugin: move to `3.4.1` or later.","reach":"internet","title":"WordPress Limit Login Attempts plugin: two-factor step can be bypassed","impact":"high","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm its two-factor authentication step succeeded before completing a login. An attacker who knows a protected user's password can skip the second factor by sending a crafted request header.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","two-factor-auth"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in as a protected user with only the password","analyst_note":"","how_to_check":"- Check the installed version of the Limit Login Attempts Security plugin in the WordPress admin under Plugins; affected if below `3.4.1`.\n- Confirm whether two-factor authentication is enabled for user accounts through the plugin.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-at-3.4.1-or-later","two-factor-not-enabled"],"who_is_affected":"Sites running the Limit Login Attempts Security WordPress plugin before 3.4.1 that use its two-factor authentication for user logins. An attacker still needs a protected user's password, so sites without two-factor enabled for that plugin are not exposed through this flaw.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000729,"input_tokens":4550,"output_tokens":548,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118202':15A,18A '-2026':14A,17A '3.4.1':36B,79C 'attack':52B,107C 'attempt':4A,31B,74C 'auth':26B 'authent':44B,88C 'break':126C 'build':100C 'bypass':12A,116C 'complet':48B,92C 'confirm':39B,82C 'craft':68B 'cve':13A,16A 'factor':8A,25B,43B,64B,87C,119C 'failur':98C 'header':70B,124C 'hold':109C 'host':22B 'know':54B 'limit':2A,29B,72C 'login':3A,30B,50B,73C,94C 'packag':19B 'password':59B,114C 'plugin':5A,34B,77C 'protect':56B,111C 'request':69B,123C 'second':63B,118C 'secur':32B,75C 'self':21B 'self-host':20B 'send':66B,121C 'skip':61B 'step':9A,45B,89C,102C,128C 'succeed':46B,90C 'success':104C 'treat':96C 'two':7A,24B,42B,86C 'two-factor':6A,41B,85C 'two-factor-auth':23B 'user':57B,112C 'wordpress':1A,27B,33B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Limit Login Attempts Security WordPress plugin before 3.4.1 that use its two-factor authentication for user logins. An attacker still needs a protected user's password, so sites without two-factor enabled for that plugin are not exposed through this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","twofactorauth","wordpress"],"campaign_type":null,"search_a":"'-118202':15A,18A '-2026':14A,17A 'attempt':4A 'bypass':12A 'cve':13A,16A 'factor':8A 'limit':2A 'login':3A 'plugin':5A 'step':9A 'two':7A 'two-factor':6A 'wordpress':1A","search_b":"'3.4.1':36B 'attack':52B 'attempt':31B 'auth':26B 'authent':44B 'complet':48B 'confirm':39B 'craft':68B 'factor':25B,43B,64B 'header':70B 'host':22B 'know':54B 'limit':29B 'login':30B,50B 'packag':19B 'password':59B 'plugin':34B 'protect':56B 'request':69B 'second':63B 'secur':32B 'self':21B 'self-host':20B 'send':66B 'skip':61B 'step':45B 'succeed':46B 'two':24B,42B 'two-factor':41B 'two-factor-auth':23B 'user':57B 'wordpress':27B,33B","search_c":"'3.4.1':79C 'attack':107C 'attempt':74C 'authent':88C 'break':126C 'build':100C 'bypass':116C 'complet':92C 'confirm':82C 'factor':87C,119C 'failur':98C 'header':124C 'hold':109C 'limit':72C 'login':73C,94C 'password':114C 'plugin':77C 'protect':111C 'request':123C 'second':118C 'secur':75C 'send':121C 'step':89C,102C,128C 'succeed':90C 'success':104C 'treat':96C 'two':86C 'two-factor':85C 'user':112C 'wordpress':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118202","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118202","severity":null,"published_at":"2026-11-09T07:17:28+00:00","modified_at":"2026-11-09T07:17:28+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}