critical · CVSS v3 9.1

CVE-2026-118202

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step…

Description

The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a protected user's password can bypass the second factor by sending a request header that breaks the step.

Scores

Severity
critical
CVSS v2
6.4
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-119506

Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.

View analysis

critical

CVE-2026-124560

A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.

View analysis

critical

CVE-2026-113363

NEC WebSAM WinShare versions 7.2.0-7.5.0, 7.6.0, and 7.7.0-7.7.2 on Windows contain an input validation flaw that allows a remote unauthenticated attacker to send a crafted packet and execute arbitrary commands with SYSTEM privileges. The vulnerability can compromise the entire host and expose sensitive data. It affects organizations using these WinShare versions.

View analysis

critical

CVE-2026-113364

NEC WebSAM WinShare on Windows has a critical buffer overflow that allows a remote unauthenticated attacker to execute code with SYSTEM privileges. The flaw exists in versions 7.5.0 and earlier, 7.6.0, and 7.7.0 through 7.7.2. It can be triggered by sending a crafted packet with a malformed data size value in the protocol header.

View analysis