CVE-2026-18356 in Limit Login Attempts Plugin

Zusammenfassung

von MITRE • 21.08.2026

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

• Zuständig: WPScan
• Reservieren: 30.07.2026
• Veröffentlichung: 21.08.2026
• Moderieren: akzeptiert
• Eintrag: VDB-394095
• CPE: bereit
• CWE: CWE-184 (bestätigt)
• CVSS: 3.7 (CNA)
• EPSS: 0.00000
• KEV: nein
• Aktivitäten: very low
• Sektor: Hostingprovider

Quellen

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-18356
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-18356
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-18356/