https://feed.craftedsignal.io/cpes/cpe2.3alimit_login_attempts_reloadedlimit_login_attempts_securitywordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 15:51:24 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-security-bypass/Mon, 09 Nov 2026 15:51:24 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-security-bypass/The Limit Login Attempts Security WordPress plugin before version 3.4.1 allows an attacker with a valid password to bypass 2FA by manipulating request headers.The Limit Login Attempts Security plugin for WordPress, in versions prior to 3.4.1, contains a flaw in its two-factor authentication (2FA) logic. The plugin fails to verify the successful completion of the 2FA step, incorrectly treating a failure to initialize the 2FA process as a successful authentication.

Impact

An attacker in possession of a valid password for a target account can bypass the second factor of authentication. By sending a specific, malformed request header that disrupts the 2FA mechanism, the attacker is granted unauthorized access to the protected account.

Recommendation

• Update the Limit Login Attempts Security plugin to version 3.4.1 or later to implement proper validation of the 2FA authentication flow.
• Audit access logs for accounts with 2FA enabled to identify anomalous authentication patterns or failed 2FA initialization attempts that resulted in successful login events.

]]>highadvisorywordpressauthentication-bypasscve-2026-118202https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/Mon, 09 Nov 2026 15:51:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/The Limit Login Attempts Security WordPress plugin fails to enforce two-factor authentication (2FA) across all authentication routes, allowing attackers with known passwords to bypass MFA via alternative login interfaces.The Limit Login Attempts Security WordPress plugin versions prior to 3.4.1 contain a vulnerability where 2FA enforcement is inconsistent across different password-authentication routes. An attacker possessing valid user credentials can leverage an alternative login interface to authenticate without completing the 2FA challenge, leading to unauthorized access. This issue is identified as CVE-2026-118201.

Impact

Successful exploitation allows an attacker to bypass 2FA protections, granting them unauthorized access to the application using valid credentials.

Recommendation

• Upgrade the Limit Login Attempts Security plugin to version 3.4.1 or later immediately.
• Review WordPress application access logs for anomalous authentication patterns or frequent login attempts from unfamiliar interfaces.
• Audit accounts with 2FA enabled to ensure the plugin's security configurations are actively enforced and not bypassed by secondary or alternative login entry points.

]]>highadvisory