LOW 3.7 NVD

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account fo

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

References

https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/

Published: 2026-08-21 · Source: NVD · Feed updated: 2026-08-21

This low severity vulnerability with a CVSS score of 3.7 was published on 2026-08-21 via NVD.

vulnfeed aggregates 11625 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.