Threats tagged 'ghsa-8mgp-m8xw-xjr2'

The Limit Login Attempts Security WordPress plugin versions before 3.4.1 contains a vulnerability where the two-factor authentication (2FA) step is not properly confirmed before completing a login. This flaw allows an attacker who knows a user's password to bypass the second factor by sending a specially crafted request header that disrupts the 2FA process.