Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
Limit Login Attempts Security - Security Vulnerability (CVE-2026-118202)
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.
PLUGIN
Limit Login Attempts Security
CVE-2026-118202
Risk Score
Threat Entry
Updated 2026-11-10
Limit Login Attempts Security - Security Vulnerability (CVE-2026-118201)
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.
PLUGIN
Limit Login Attempts Security
CVE-2026-118201
Risk Score