{"id":"CVE-2026-118202","aliases":["EUVD-2026-119823","GHSA-8mgp-m8xw-xjr2"],"status":"published","title":"Limit Login Attempts Reloaded \u003c 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00245,"percentile":0.15929,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-11-09T06:00:26Z","modified":"2026-11-09T14:12:17Z","products":[{"vendor":"unknown","product":"limit login attempts security"}],"references":[{"url":"https://wpscan.com/vulnerability/b2776c0c-7542-487d-976f-1ea3a646517f/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118202"},{"url":"https://wpscan.com/vulnerability/b2776c0c-7542-487d-976f-1ea3a646517f"},{"url":"https://github.com/advisories/GHSA-8mgp-m8xw-xjr2"}],"sources":{"cve":[{"id":"CVE-2026-118202","title":"Limit Login Attempts Reloaded \u003c 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","status":"published","published":"2026-11-09T06:00:26.954Z","modified":"2026-11-09T14:12:17.476Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T15:33:44.265689Z"}],"euvd":[{"id":"EUVD-2026-119823","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","status":"published","published":"2026-11-09T06:00:26Z","modified":"2026-11-09T14:12:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-09T15:17:13.549805Z"}],"ghsa":[{"id":"GHSA-8mgp-m8xw-xjr2","title":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two...","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","status":"published","published":"2026-11-09T09:31:42Z","modified":"2026-11-09T15:33:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T15:48:42.843855Z"}],"nvd":[{"id":"CVE-2026-118202","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","status":"published","published":"2026-11-09T07:17:28.49Z","modified":"2026-11-10T16:28:46.51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-09T18:15:14.951948Z"}]}}