{"affected":[{"defaultStatus":"unaffected","product":"Limit Login Attempts Security","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.4.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118202","cwes":["CWE-287"],"description":"The Limit Login Attempts Security  WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/b2776c0c-7542-487d-976f-1ea3a646517f/"}],"kev":null,"metrics":[],"modifiedAt":1794204026954,"publishedAt":1794204026954,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/b2776c0c-7542-487d-976f-1ea3a646517f/"}],"remediation":[],"revision":"a2c8268e9c4d4ef3a92037ef2e87cad94c3c4c4f7a8aa41f60cf4e50e68dad31","sources":[{"modifiedAt":1794204026954,"name":"CNA: WPScan","retrievedAt":1794208112336,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118202"}],"ssvc":null,"status":"published","title":"Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header","updatedAt":1794208112336}