CVE-2020-35590: 
WordPress vulnerability analysis and mitigation

CVE-2020-35590 is a security vulnerability discovered in the limit-login-attempts-reloaded WordPress plugin versions before 2.17.4. The vulnerability was disclosed on December 14, 2020, and allows attackers to bypass the plugin's rate-limiting protection mechanism. The issue affects WordPress installations that have configured the plugin to use custom headers for client IP addresses (N4nj0 Advisory, WPScan).

The vulnerability exists in LimitLoginAttempts.php when the plugin is configured with a custom header in its Trusted IP Origins setting (e.g., X-Forwarded-For). The core issue is that the plugin accepts any arbitrary string in the client IP header without proper validation. When an attacker randomizes the header input, the login attempt counter never reaches the maximum allowed retries, effectively bypassing the brute force protection. The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical) due to its network attack vector, low attack complexity, and no required privileges or user interaction (NVD).

By exploiting this vulnerability, attackers can perform unlimited login attempts against WordPress user accounts, effectively bypassing the plugin's core functionality of preventing brute force attacks. This could potentially lead to unauthorized access to WordPress accounts if weak passwords are used (N4nj0 Advisory).

The vulnerability is exploitable when the plugin is configured to accept custom headers for client IP addresses. An attacker can exploit this by sending login requests with randomized X-Forwarded-For header values, preventing the plugin from properly tracking failed login attempts. A proof-of-concept exploit has been publicly released (N4nj0 Advisory).

The vulnerability has been patched in version 2.17.4 of the limit-login-attempts-reloaded plugin. Site administrators should update to this version or later immediately. If immediate updating is not possible, administrators should avoid using custom headers in the Trusted IP Origins setting (WPScan).