CVE-2026-18356CWE-184

CVE-2026-18356

Low · published August 21, 2026

CVSS v3.1

3.7

EPSS

Percentile

16.2

In the wild

Unconfirmed

What it is

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

The record

Technical detail

CVSS v3.1: 3.7 · LOW
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00256 · 16.2th percentile
Weakness: CWE-184 · Incomplete List of Disallowed Inputs
Published: 2026-08-21T16:16Z

References (1)

https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/ · [email protected]

EPSS history

Timeline

21 AUG 11:40Z
Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
cvelistv5