CVE-2026-118201: Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

Q: Who can exploit this issue?

An attacker must already know the password of a user protected by two-factor authentication. They can then use an alternative password-authentication route to gain access without supplying the second factor.

Q: Are installations using the default login path affected?

The issue concerns password-authentication routes where the plugin does not enforce two-factor authentication, specifically including XML-RPC as indicated by the vulnerability title. The provided information does not establish whether the standard WordPress login path is affected.

Q: What versions should be remediated?

Versions before 3.4.1 are affected; the reported affected range is 3.0.0 through 3.4.0. Upgrade to 3.4.1 or later.

Published Nov 9, 2026

Updated

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.

Affected Software

1 affected component

Limit Login Attempts Reloaded Limit Login Attempts Reloaded<3.4.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

An attacker must already know the password of a user protected by two-factor authentication. They can then use an alternative password-authentication route to gain access without supplying the second factor.

Are installations using the default login path affected?

The issue concerns password-authentication routes where the plugin does not enforce two-factor authentication, specifically including XML-RPC as indicated by the vulnerability title. The provided information does not establish whether the standard WordPress login path is affected.

What versions should be remediated?

Versions before 3.4.1 are affected; the reported affected range is 3.0.0 through 3.4.0. Upgrade to 3.4.1 or later.

CVE-2026-118201: Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Are installations using the default login path affected?

What versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Are installations using the default login path affected?

What versions should be remediated?