Limit Login Attempts Reloaded <= 2.17.3 - Login Rate Limiting Bypass
Strategic Overview
- Status
- Patched in 2.17.4
- Affected Plugin
- Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
- Affected Version
<= 2.17.3- CVSS
- 7.3High
- Weakness type
- CWE-307 · Improper Restriction of Excessive Authentication Attempts
- CVE
CVE-2020-35590
At a glance
CVE-2020-35590 is a high-severity Improper Restriction of Excessive Authentication Attempts vulnerability in the Limit Login Attempts Security WordPress plugin, affecting versions <= 2.17.3. It carries a CVSS score of 7.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 2.17.4; sites on affected versions should update now. Disclosed December 2020, reported by n4nj0.
Vulnerability Overview
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.
CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
Remediation
Update to version 2.17.4, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: Limit Login Attempts Security 2.17.4 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Related records
Other vulnerabilities in Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C