Vulnerability · Published Aug 21, 2026 · Assigned by WPScan
CVE-2026-18356Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
Low 3.7
In plain English
A low-severity security flaw in Limit Login Attempts Security from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.3%top 82.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Limit Login Attempts Security | 0 – before 3.3.5 |
Weakness: CWE-184 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/ exploit, vdb-entry, technical-description