CVE-2026-18356 — Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's e…
Published: 2026-08-21 · CVSS: 3.7 · CVSS 3.1
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7