Vulnerabilities > Limitloginattempts > Limit Login Attempts Reloaded > Critical

DATE CVE VULNERABILITY TITLE RISK
2020-12-21 CVE-2020-35590 Improper Restriction of Excessive Authentication Attempts vulnerability in Limitloginattempts Limit Login Attempts Reloaded
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged.
network
low complexity
limitloginattempts CWE-307
critical
 9.8
9.8