Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security <= 3.4.2 - Unauthenticated Login Attempt Limit Bypass via IPv6 Address Rotation
- ID
- WPSEC-2026-3138
- Plugin
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention (limit-login-attempts-reloaded)
- Affected
- all versions before 3.4.3
- Remediation
- Update to 3.4.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-307
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-11-14
- Attack surface
- Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security on WPSec AttackSurface
- Fix released
- Published
Description
The Limit Login Attempts Security plugin for WordPress is vulnerable to a login attempt limit bypass via IPv6 address rotation in all versions up to, and including, 3.4.2, due to failed login retries and lockouts being tracked per full client IP address rather than per IPv6 network. This makes it possible for unauthenticated attackers connecting over IPv6, who typically control an entire /64 range, to change the interface identifier of their address on each attempt so that the retry counter never builds up and the local lockout is never applied, allowing unlimited brute-force attempts against user passwords.
References
- https://wpsec.com/vuln/WPSEC-2026-3138/
- https://plugins.svn.wordpress.org/limit-login-attempts-reloaded/tags/3.4.3/
- https://wordpress.org/plugins/limit-login-attempts-reloaded/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS