CVE-2020-35590
9.8
CRITICAL · CVSS 3.1 · EPSS 4.3% (pctl 91)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 4.35% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-307 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-12-21 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| limitloginattempts | limit login attempts reloaded |
References
- https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/
- https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers
- https://n4nj0.github.io/advisories/wordpress-plugin-limit-login-attempts-reloaded/
- https://wordpress.org/plugins/limit-login-attempts-reloaded/#developers
→ the Explorer · watch your stack · NVD