PLUGIN SECURITY
Is Limit Login Attempts Reloaded safe?
Limit login attempts and stop brute force attacks. WordPress security with 2FA, firewall, bot protection, IP blocking, and secure login monitoring.
What this plugin does
- Slug:
limit-login-attempts-reloaded - Author: WPChef
- 1000000+ active installs
- 96/100 rating (1489 reviews on wordpress.org)
- 100625919 all-time downloads
- On WordPress.org since 2016-08-03
2FABrute Forcefirewalllogin securitysecurity
Maintenance status
- Latest known version: 3.3.4
- Last updated: 2026-11-06 10:28am GMT
- Tested up to WordPress: 7.1.4
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
8 known CVEs on file for Limit Login Attempts Reloaded. Reported between 2020 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-118201 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] >= 3.0.0 - < 3.4.1 | Improper Authentication | Unknown | 3.0.0–3.4.1 | 3.4.1 | 2026-11-09 | ⚠ update needed |
| CVE-2026-118202 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.4.1 | Improper Authentication | Unknown | < 3.4.1 | 3.4.1 | 2026-11-09 | ⚠ update needed |
| CVE-2026-18356 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.3.5 | Incomplete List of Disallowed Inputs | Low 3.7 | < 3.3.5 | 3.3.5 | 2026-08-21 | ⚠ update needed |
| CVE-2026-118439 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 3.4.2 | Server-Side Request Forgery (SSRF) | Unknown | < 3.4.2 | 3.4.2 | 2026-08-17 | ⚠ update needed |
| CVE-2023-6934 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.25.27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.25.27 | 2.25.27 | 2023-12-20 | ✓ fixed in latest |
| CVE-2023-5525 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.25.26 | Missing Authorization | Medium 4.3 | < 2.25.26 | 2.25.26 | 2023-11-06 | ✓ fixed in latest |
| — | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.16.0 | — | Unknown | < 2.16.0 | 2.16.0 | 2020-12-21 | ✓ fixed in latest |
| — | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 | — | Unknown | < 2.17.4 | 2.17.4 | 2020-12-21 | ✓ fixed in latest |
+ 2 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2020-35589 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 2.17.4 | 2.17.4 | 2020-12-14 | ✓ fixed in latest |
| CVE-2020-35590 | Limit Login Attempts Security – Brute Force Protection, 2FA, Firewall & Login Security [limit-login-attempts-reloaded] < 2.17.4 | Improper Restriction of Excessive Authentication Attempts | Critical 9.8 | < 2.17.4 | 2.17.4 | 2020-12-14 | ✓ fixed in latest |
How to fix it
Keep Limit Login Attempts Reloaded updated — 3.3.4 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ active installs — 94/100 (5043) — max PHP 8.4
- Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ active installs — 98/100 (8871) — max PHP 8.4
- Two Factor — 100000+ active installs — 94/100 (210) — max PHP 8.4
- WP 2FA – Two-factor authentication for WordPress — 100000+ active installs — 94/100 (184)
- CloudSecure WP Security — 100000+ active installs — 100/100 (2) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.