CVE-2020-35590

EIP tracks 1 public exploit for CVE-2020-35590. PoCs published by N4nj0.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2020-35590, which bypasses login rate limits in the WordPress plugin 'Limit Login Attempts Reloaded' by manipulating HTTP headers like X-Forwarded-For. The exploit demonstrates how unvalidated headers can defeat the plugin's brute-force protection.

LimitLoginAttempts.php in the limit-login-attempts-reloaded plugin before 2.17.4 for WordPress allows a bypass of (per IP address) rate limits because the X-Forwarded-For header can be forged. When the plugin is configured to accept an arbitrary header for the client source IP address, a malicious user is not limited to perform a brute force attack, because the client IP header accepts any arbitrary string. When randomizing the header input, the login count does not ever reach the maximum allowed retries.