# Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security <= 3.4.2 - Unauthenticated Login Attempt Limit Bypass via IPv6 Address Rotation

- **ID:** WPSEC-2026-3138
- **Plugin:** Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention (`limit-login-attempts-reloaded`), https://wordpress.org/plugins/limit-login-attempts-reloaded/
- **Affected versions:** all versions before 3.4.3
- **Fixed in:** 3.4.3 (Update to 3.4.3 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-307
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-11-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/limit-login-attempts-reloaded
- **Fix released:** 2026-11-13
- **Published:** 2026-11-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3138/

## Description

The Limit Login Attempts Security plugin for WordPress is vulnerable to a login attempt limit bypass via IPv6 address rotation in all versions up to, and including, 3.4.2, due to failed login retries and lockouts being tracked per full client IP address rather than per IPv6 network. This makes it possible for unauthenticated attackers connecting over IPv6, who typically control an entire /64 range, to change the interface identifier of their address on each attempt so that the retry counter never builds up and the local lockout is never applied, allowing unlimited brute-force attempts against user passwords.

## References

- https://wpsec.com/vuln/WPSEC-2026-3138/
- https://plugins.svn.wordpress.org/limit-login-attempts-reloaded/tags/3.4.3/
- https://wordpress.org/plugins/limit-login-attempts-reloaded/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3138/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.