Limit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118202)

The Limit Login Attempts Security plugin for WordPress, in versions prior to 3.4.1, contains a flaw in its two-factor authentication (2FA) logic. The plugin fails to verify the successful completion of the 2FA step, incorrectly treating a failure to initialize the 2FA process as a successful authentication.

Impact

An attacker in possession of a valid password for a target account can bypass the second factor of authentication. By sending a specific, malformed request header that disrupts the 2FA mechanism, the attacker is granted unauthorized access to the protected account.

Recommendation

• Update the Limit Login Attempts Security plugin to version 3.4.1 or later to implement proper validation of the 2FA authentication flow.
• Audit access logs for accounts with 2FA enabled to identify anomalous authentication patterns or failed 2FA initialization attempts that resulted in successful login events.