Limit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118201)

The Limit Login Attempts Security WordPress plugin versions prior to 3.4.1 contain a vulnerability where 2FA enforcement is inconsistent across different password-authentication routes. An attacker possessing valid user credentials can leverage an alternative login interface to authenticate without completing the 2FA challenge, leading to unauthorized access. This issue is identified as CVE-2026-118201.

Impact

Successful exploitation allows an attacker to bypass 2FA protections, granting them unauthorized access to the application using valid credentials.

Recommendation

• Upgrade the Limit Login Attempts Security plugin to version 3.4.1 or later immediately.
• Review WordPress application access logs for anomalous authentication patterns or frequent login attempts from unfamiliar interfaces.
• Audit accounts with 2FA enabled to ensure the plugin's security configurations are actively enforced and not bypassed by secondary or alternative login entry points.