{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3alimit_login_attempts_reloadedlimit_login_attempts_securitywordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:limit_login_attempts_reloaded:limit_login_attempts_security:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118202"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Limit Login Attempts Security (\u003c 3.4.1)"],"_cs_severities":["high"],"_cs_tags":["wordpress","authentication-bypass","cve-2026-118202"],"_cs_type":"advisory","_cs_vendors":["Limit Login Attempts Security"],"content_html":"\u003cp\u003eThe Limit Login Attempts Security plugin for WordPress, in versions prior to 3.4.1, contains a flaw in its two-factor authentication (2FA) logic. The plugin fails to verify the successful completion of the 2FA step, incorrectly treating a failure to initialize the 2FA process as a successful authentication.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker in possession of a valid password for a target account can bypass the second factor of authentication. By sending a specific, malformed request header that disrupts the 2FA mechanism, the attacker is granted unauthorized access to the protected account.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Limit Login Attempts Security plugin to version 3.4.1 or later to implement proper validation of the 2FA authentication flow.\u003c/li\u003e\n\u003cli\u003eAudit access logs for accounts with 2FA enabled to identify anomalous authentication patterns or failed 2FA initialization attempts that resulted in successful login events.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:24Z","date_published":"2026-11-09T15:51:24Z","id":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-security-bypass/","summary":"The Limit Login Attempts Security WordPress plugin before version 3.4.1 allows an attacker with a valid password to bypass 2FA by manipulating request headers.","title":"Limit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118202)","url":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-security-bypass/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:limit_login_attempts_reloaded:limit_login_attempts_security:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118201"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Limit Login Attempts Security (\u003c 3.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Limit Login Attempts Reloaded"],"content_html":"\u003cp\u003eThe Limit Login Attempts Security WordPress plugin versions prior to 3.4.1 contain a vulnerability where 2FA enforcement is inconsistent across different password-authentication routes. An attacker possessing valid user credentials can leverage an alternative login interface to authenticate without completing the 2FA challenge, leading to unauthorized access. This issue is identified as CVE-2026-118201.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to bypass 2FA protections, granting them unauthorized access to the application using valid credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Limit Login Attempts Security plugin to version 3.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview WordPress application access logs for anomalous authentication patterns or frequent login attempts from unfamiliar interfaces.\u003c/li\u003e\n\u003cli\u003eAudit accounts with 2FA enabled to ensure the plugin's security configurations are actively enforced and not bypassed by secondary or alternative login entry points.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:19Z","date_published":"2026-11-09T15:51:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/","summary":"The Limit Login Attempts Security WordPress plugin fails to enforce two-factor authentication (2FA) across all authentication routes, allowing attackers with known passwords to bypass MFA via alternative login interfaces.","title":"Limit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118201)","url":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:limit_login_attempts_reloaded:limit_login_attempts_security:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}