¿Es seguro Limit Login Attempts Reloaded?

Qué hace este plugin

• Slug: limit-login-attempts-reloaded
• 1000000+ instalaciones activas

2FABrute Forcefirewalllogin securitysecurity

Estado de mantenimiento

• Última versión conocida: 3.3.4
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Limit Login Attempts Reloaded. Reportadas entre 2020 y 2023.

CVE-2023-6934

Update the WordPress Limit Login Attempts Reloaded plugin to the latest available version (at least 2.25.27). Hung -mov Nguyen discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Limit Login Attempts Reloaded Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.25.27. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-5525

The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_auto_update() function hooked via AJAX in all versions up to, and including, 2.25.25. This makes it possible for authenticated attackers, with access to a valid nonce, to toggle auto-updates for the plugin on and off.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.16.0

Authenticated Reflected Cross-Site Scripting (XSS) vulnerability found by n4nj0 in WordPress Limit Login Attempts Reloaded plugin (versions <= 2.15.2).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Limit Login Attempts Security – Login Security, 2FA, Firewall, Brute Force Prevention [limit-login-attempts-reloaded] < 2.17.4

Login Rate Limiting Bypass vulnerability found by n4nj0 in WordPress Limit Login Attempts Reloaded plugin (versions <= 2.17.3).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2020-35589

The limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows wp-admin/options-general.php?page=limit-login-attempts&tab= XSS. A malicious user can cause an administrator user to supply dangerous content to the vulnerable page, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2020-35590

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Cómo solucionarlo

Mantén Limit Login Attempts Reloaded actualizado — 3.3.4 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Wordfence Security – Firewall, Malware Scan, and Login Security — 5000000+ instalaciones activas — 94/100 (4948) — PHP máx. 8.4
• Really Simple Security – Simple and Performant Security (formerly Really Simple SSL) — 3000000+ instalaciones activas — 98/100 (8847) — PHP máx. 8.4
• Two Factor — 100000+ instalaciones activas — 96/100 (210) — PHP máx. 8.4
• WP 2FA – Two-factor authentication for WordPress — 100000+ instalaciones activas — 94/100 (170)
• Anti-Malware Security and Brute-Force Firewall — 100000+ instalaciones activas — 98/100 (784)