{"affected":[{"defaultStatus":"unaffected","product":"Limit Login Attempts Security","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.4.1","status":"affected","version":"3.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118201","cwes":["CWE-287"],"description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/a3754c82-0b21-45a7-a3c8-d47ef155a327/"}],"kev":null,"metrics":[],"modifiedAt":1794204026783,"publishedAt":1794204026783,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/a3754c82-0b21-45a7-a3c8-d47ef155a327/"}],"remediation":[],"revision":"2664d184f036980572baeccea1aead74724b97b57445fc9f0d1ce2c3cbbf9b73","sources":[{"modifiedAt":1794204026783,"name":"CNA: WPScan","retrievedAt":1794208110946,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118201"}],"ssvc":null,"status":"published","title":"Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC","updatedAt":1794208110946}