WordPress 2FA Bypass via Alternative Authentication Routes

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Limit Login Attempts Security WordPress plugin before version 3.4.1 contains an authentication bypass vulnerability where two-factor authentication (2FA) enforcement is inconsistently applied across login endpoints. An attacker with valid credentials can circumvent the second authentication factor by exploiting alternative login interfaces that lack 2FA validation, effectively reducing multi-factor security to single-factor authentication. This vulnerability affects WordPress administrators and users relying on this plugin for account protection, particularly organizations using WordPress for content management or customer-facing applications where credential compromise poses significant risk.

Casky's 283 mapped security skills detect the attack patterns behind this vulnerability by correlating MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky's Claude-powered analysis would observe detection patterns identifying: (1) authentication attempts bypassing expected 2FA challenges, (2) successful logins from known compromised accounts without second-factor completion, and (3) inconsistent security control enforcement across application endpoints. The platform's extended reasoning capabilities map these behavioral indicators to CWE-287 (Improper Authentication) patterns, helping security teams identify when attackers exploit alternative login routes as a privilege escalation vector to gain unauthorized access to high-value accounts—enabling rapid response before lateral movement or data exfiltration occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-118201.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-118201

Casky has 283 skills that investigate the attack patterns behind CVE-2026-118201. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn