Limit Login Attempts Security (< 3.4.1)

The Limit Login Attempts Security WordPress plugin before version 3.4.1 allows an attacker with a valid password to bypass 2FA by manipulating request headers.

The Limit Login Attempts Security WordPress plugin fails to enforce two-factor authentication (2FA) across all authentication routes, allowing attackers with known passwords to bypass MFA via alternative login interfaces.