Vulnerability in Limit Login Attempts Security Plugin Affects WordPress Users
CVE-2026-118202
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 November 2026
Badges
What is CVE-2026-118202?
The Limit Login Attempts Security plugin for WordPress, prior to version 3.4.1, contains a flaw that allows an attacker to bypass the two-factor authentication mechanism. This occurs due to the plugin's failure to successfully validate the two-factor authentication step during the login process. The vulnerability arises when an attacker, armed with a user's password, sends a specially crafted request header that disrupts the authentication flow. As a result, the system mistakenly treats the authentication process as successful, allowing unauthorized access to the protected account.
Affected Version(s)
Limit Login Attempts Security 0 < 3.4.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.