Two-Factor Authentication Bypass in Limit Login Attempts Security WordPress Plugin
CVE-2026-118201
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 November 2026
Badges
What is CVE-2026-118201?
The Limit Login Attempts Security plugin for WordPress, prior to version 3.4.1, is vulnerable to an authentication bypass due to inadequate enforcement of two-factor authentication (2FA) on all login avenues. An attacker with knowledge of a user's password can exploit this vulnerability by using an alternative login path, thereby gaining unauthorized access to the user's account without being prompted for the second factor of authentication. This weakness can lead to unauthorized actions within the user's account and potentially compromise sensitive information.
Affected Version(s)
Limit Login Attempts Security 3.0.0 < 3.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.