Limit Login Attempts Reloaded - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/limit-login-attempts-reloaded/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 09 Nov 2026 15:51:19 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLimit Login Attempts Security: Two-factor authentication bypass (CVE-2026-118201)https://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/Mon, 09 Nov 2026 15:51:19 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-limit-login-attempts-2fa-bypass/The Limit Login Attempts Security WordPress plugin fails to enforce two-factor authentication (2FA) across all authentication routes, allowing attackers with known passwords to bypass MFA via alternative login interfaces.The Limit Login Attempts Security WordPress plugin versions prior to 3.4.1 contain a vulnerability where 2FA enforcement is inconsistent across different password-authentication routes. An attacker possessing valid user credentials can leverage an alternative login interface to authenticate without completing the 2FA challenge, leading to unauthorized access. This issue is identified as CVE-2026-118201.

Impact

Successful exploitation allows an attacker to bypass 2FA protections, granting them unauthorized access to the application using valid credentials.

Recommendation

  • Upgrade the Limit Login Attempts Security plugin to version 3.4.1 or later immediately.
  • Review WordPress application access logs for anomalous authentication patterns or frequent login attempts from unfamiliar interfaces.
  • Audit accounts with 2FA enabled to ensure the plugin's security configurations are actively enforced and not bypassed by secondary or alternative login entry points.
]]>highadvisory