The vulnerability in the Limit Login Attempts Security WordPress plugin prevents the enforced two‑factor authentication from being applied to all password‑authentication routes. An attacker who has acquired a legitimate user’s password can therefore log in through an alternative mechanism (notably the XML‑RPC interface) without completing the second factor, effectively bypassing the intended protection. This permits an attacker with knowledge of a user’s password to impersonate that user, potentially accessing any data or administrative functions available to the user.

All WordPress installations that use the Limit Login Attempts Security plugin prior to version 3.4.1 are affected. The plugin’s name is simply “Limit Login Attempts Security”; no vendor name is provided in the advisory. Sites running any of the 3.0.0 through 3.4.0 releases that enable XML‑RPC for login should be considered vulnerable.

The advisory does not provide a CVSS score or EPSS value, and the vulnerability is not listed in CISA’s KEV catalog. Despite the lack of quantitative scoring, the flaw enables an authentication bypass that could lead to complete account takeover. An attacker must first learn a user’s password – through a prior compromise, phishing, or other means – but once that credential is in hand, the bypass can be executed immediately without additional privileges. The exploitation path does not require network-level access beyond the normal access allowed to the XML‑RPC interface, making it potentially widely reachable on exposed WordPress sites.