The vulnerability in the Limit Login Attempts Security WordPress plugin allows an attacker who has a user’s password to bypass the two‑factor authentication step. The plugin fails to verify that the second factor succeeded before completing a login, treating a failure as a success. This results in a direct authentication bypass that grants full user privileges without the need for the second factor, representing a severe compromise of account integrity.

WordPress sites running the Limit Login Attempts Security plugin with a version older than 3.4.1 are affected. The plugin’s developers have not credited a specific CNA, but the vulnerability is identified in the plugin’s version history and reported in the WordPress vulnerability database.

The flaw can be exploited by sending a HTTP request containing a malformed X‑Forwarded‑For header that breaks the second‑factor processing. Because the attacker only demands the user’s password and a crafted header, the attack is straightforward for anyone with password knowledge. The exploit does not require privileged access or complex setup. Although EPSS data is not available, the severity of the authentication bypass and lack of a required second factor suggest a high impact and low friction exploitation path. The vulnerability is not currently listed in CISA’s KEV catalog, but its potential to subvert two‑factor protection warrants urgent attention.