Limit Login Attempts Reloaded <= 3.4.0 — Two-Factor Authentication Bypass

Am I affected?

• Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Limit Login Attempts Security.
• No admin access? Run a passive check of your site. It reads public files only.

What to do

1. Update to version 3.4.1, or a newer patched version
2. Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
3. Watch Limit Login Attempts Security to get an email when the next vulnerability is published.

Advisory

Source description from Wordfence Intelligence, credited to Naoki Kawahigashi.

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in all versions up to, and including, 3.4.0. This is due to a failure to confirm that the two-factor authentication step completed successfully before granting access, combined with treating an inability to construct that step as a passing result. This makes it possible for unauthenticated attackers to skip the second authentication factor entirely and complete a login as that user by supplying a request header that prevents the two-factor step from initialising, which the plugin erroneously interprets as a passed check. The targeted account must have two-factor authentication enabled through the plugin, and the attacker must already know that account's password.

Exploits & references

Proof-of-concept & detection

No public proof-of-concept or detection template is known for this vulnerability.

Advisories & patches

• Advisorywordfence.com

Related CVEs

Timeline

1. Nov 6, 2026

   CVE published

   Severity medium, CVSS 4.3

2. Nov 13, 2026

   Record last updated