CVE-2026-18356

Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

Affected

Limit Login Attempts Security

CVSS v3.1 WPSCAN

3.7 LOWCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS

0.26% chance of exploitation in the next 30 days, 16th percentile

Published

2026-08-21

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/

References

• CVE Record
• NVD entry