CVE-2026-18356
Low
Description
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
SeverityLow
CVSS3.7
Exploit probability—
ProductLimit Login Attempts Security
PublishedAug 21, 2026
First seenAug 21, 2026
Weakness typeCWE-184CWE-184
How to fix
Update
- Limit Login Attempts Security3.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Limit Login Attempts Security | v < 3.3.5 | 3.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.