CVE-2026-18356

LOW CVSS 3.7 View on NVD ↗

Description

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/

Published: Aug 21, 2026 12:16 UTC Modified: Aug 21, 2026 13:16 UTC