{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/limit-login-attempts-reloaded/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:limit_login_attempts_reloaded:limit_login_attempts_security:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118201"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Limit Login Attempts Security (\u003c 3.4.1)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Limit Login Attempts Reloaded"],"content_html":"\u003cp\u003eThe Limit Login Attempts Security WordPress plugin versions prior to 3.4.1 contain a vulnerability where 2FA enforcement is inconsistent across different password-authentication routes. An attacker possessing valid user credentials can leverage an alternative login interface to authenticate without completing the 2FA challenge, leading to unauthorized access. This issue is identified as CVE-2026-118201.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to bypass 2FA protections, granting them unauthorized access to the application using valid credentials.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Limit Login Attempts Security plugin to version 3.4.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eReview WordPress application access logs for anomalous authentication patterns or frequent login attempts from unfamiliar interfaces.\u003c/li\u003e\n\u003cli\u003eAudit accounts with 2FA enabled to ensure the plugin's security configurations are actively enforced and not bypassed by secondary or alternative login entry points.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-09T15:51:19Z","date_published":"2026-11-09T15:51:19Z","id":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/","summary":"The Limit Login Attempts Security WordPress plugin fails to enforce two-factor authentication (2FA) across all authentication routes, allowing attackers with known passwords to bypass MFA via alternative login interfaces.","title":"Limit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118201)","url":"https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Limit Login Attempts Reloaded","version":"https://jsonfeed.org/version/1.1"}