{"id":"CVE-2026-118201","aliases":["EUVD-2026-119822","GHSA-23f7-52jh-vwrc"],"status":"published","title":"Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00231,"percentile":0.14121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-11-09T06:00:26Z","modified":"2026-11-09T14:12:17Z","products":[{"vendor":"unknown","product":"limit login attempts security"}],"references":[{"url":"https://wpscan.com/vulnerability/a3754c82-0b21-45a7-a3c8-d47ef155a327/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118201"},{"url":"https://wpscan.com/vulnerability/a3754c82-0b21-45a7-a3c8-d47ef155a327"},{"url":"https://github.com/advisories/GHSA-23f7-52jh-vwrc"}],"sources":{"cve":[{"id":"CVE-2026-118201","title":"Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","status":"published","published":"2026-11-09T06:00:26.783Z","modified":"2026-11-09T14:12:17.619Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T15:33:44.265689Z"}],"euvd":[{"id":"EUVD-2026-119822","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","status":"published","published":"2026-11-09T06:00:26Z","modified":"2026-11-09T14:12:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T15:17:13.549805Z"}],"ghsa":[{"id":"GHSA-23f7-52jh-vwrc","title":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor...","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","status":"published","published":"2026-11-09T09:31:42Z","modified":"2026-11-09T15:33:09Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T15:48:42.843855Z"}],"nvd":[{"id":"CVE-2026-118201","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","status":"published","published":"2026-11-09T07:17:28.357Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T18:15:14.951948Z"}]}}