WordPress 2FA Bypass via Failed Authentication Step

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-118202 exposes a critical authentication flaw in the Limit Login Attempts Security WordPress plugin versions before 3.4.1. The vulnerability stems from improper validation logic that treats a failed two-factor authentication step as a successful completion, allowing attackers who possess a user's password to bypass the second factor entirely by crafting malicious request headers. This affects WordPress site administrators and users relying on this plugin for enhanced login security, potentially compromising any account protected by the two-factor mechanism. With a CVSS score of 7.5 and CWE-287 (Improper Authentication) classification, this represents a high-severity authentication bypass that directly undermines the security posture of affected installations.

Casky's 283 mapped security skills detect this vulnerability by analyzing authentication and access control attack patterns across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify suspicious patterns including: requests with malformed or missing two-factor validation headers, successful login completions without proper multi-factor confirmation logs, and authentication state transitions that skip expected validation steps. Claude's extended reasoning capabilities help correlate these indicators with the underlying logic flaw—recognizing that failure-to-build conditions in the authentication flow are being mishandled as success states. Security teams would see findings highlighting abnormal authentication chains, missing second-factor verification events, and accounts accessed despite configured 2FA requirements, enabling rapid detection and remediation before attackers exploit the bypass at scale.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-118202.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-118202

Casky has 283 skills that investigate the attack patterns behind CVE-2026-118202. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn