CVE-2020-35590: Limitloginattempts Limit Login Attempts Reloaded

Critical severity, CVSS 9.8. EPSS: 4.3% chance of exploitation in the next 30 days.

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.

Affected products

• Limitloginattempts Limit Login Attempts Reloaded: before 2.17.4 (fixed in 2.17.4)

Published 2020-12-21. Last modified 2026-06-17.