Security Alert Summary
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 contains an authentication bypass related to its username denylist handling. The plugin does not perform case-insensitive comparisons against the denylist and does not account for the account’s email address, which can allow an account an administrator intended to block from successfully authenticating.
CVE Details
- CVE ID: CVE-2026-18356
- Affected component: Limit Login Attempts Reloaded WordPress plugin (described in the advisory)
- Affected versions: Versions before 3.3.5 (lessThan 3.3.5)
- Published: August 21, 2026 at 12:16:24 PM UTC
- Last modified: August 21, 2026 at 01:16:55 PM UTC
- CVSS v3.1: Base score 3.7 (LOW) —
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No privileges required (PR:N); no user interaction required (UI:N); attack complexity is high (AC:H)
- Primary impact: Confidentiality: None; Integrity: Low; Availability: None
- Weakness (CWE): CWE-184
Technical Details
According to the advisory, the plugin fails to match login identifiers against its username denylist in a case-insensitive manner and it does not account for an account’s email address when enforcing the denylist. As a result, an account that an administrator intended to block can still authenticate if the comparison ignores case differences or if the account attempts to log in using an email address that is not checked by the denylist logic.
The description does not name specific functions or REST API endpoints. The root cause is a mismatch between how the denylist is checked and how login identifiers (usernames and email addresses) are supplied, so the denylist checks can be bypassed under the described conditions. The practical impact is an unintended authentication of accounts that were intended to be blocked, consistent with the CVSS integrity impact of “Low.”
How This Could Impact Your Website
Consider a site owner who removes a former contractor’s access by adding their username to the plugin denylist. If that denylist is checked case-sensitively or ignores the account email, the former contractor might still be able to log in using a variation of their username or their email address. On a multisite or multiuser install, this could allow an unintended account to authenticate and access areas available to that account’s role, affecting internal staff workflows and potentially exposing role-specific data.
Practical consequences include increased risk of targeted phishing or social engineering against known users and possible unauthorized access to content or editorial features tied to that account. It may also complicate incident response if blocked accounts continue to appear active in logs. If you\’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor roles.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from the site.
- Monitor site activity and authentication logs for unusual behavior or unexpected logins.
If you\’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
