{
 "id": "WPSEC-2026-3138",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3138/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3138/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3138/index.md",
 "title": "Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security <= 3.4.2 - Unauthenticated Login Attempt Limit Bypass via IPv6 Address Rotation",
 "description": "The Limit Login Attempts Security plugin for WordPress is vulnerable to a login attempt limit bypass via IPv6 address rotation in all versions up to, and including, 3.4.2, due to failed login retries and lockouts being tracked per full client IP address rather than per IPv6 network. This makes it possible for unauthenticated attackers connecting over IPv6, who typically control an entire /64 range, to change the interface identifier of their address on each attempt so that the retry counter never builds up and the local lockout is never applied, allowing unlimited brute-force attempts against user passwords.",
 "plugin": {
  "slug": "limit-login-attempts-reloaded",
  "name": "Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security",
  "full_name": "Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention",
  "wordpress_org": "https://wordpress.org/plugins/limit-login-attempts-reloaded/",
  "advisories_url": "https://wpsec.com/vuln/plugin/limit-login-attempts-reloaded/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/limit-login-attempts-reloaded"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-307"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.4.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.4.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.4.3",
 "remediation": "Update to 3.4.3 or later.",
 "fix_released": "2026-11-13T09:30:03+00:00",
 "published": "2026-11-14T09:40:51+00:00",
 "updated": "2026-11-13T15:53:47.157107+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3138/",
  "https://plugins.svn.wordpress.org/limit-login-attempts-reloaded/tags/3.4.3/",
  "https://wordpress.org/plugins/limit-login-attempts-reloaded/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/limit-login-attempts-reloaded",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-11-14"
 }
}