CVE-2026-18356 Limit Login Attempts Reloaded CVE debrief

Who should care

Administrators using the Limit Login Attempts Reloaded plugin, security teams responsible for vulnerability management, and operators of WordPress installations should be aware of this issue and take necessary actions to verify and mitigate the vulnerability. This may involve reviewing plugin versions, updating to 3.3.5 or later, and monitoring for potential unauthorized access attempts.

Technical summary

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway. This issue may allow unauthorized access to WordPress installations using the vulnerable plugin. Administrators should verify the plugin version and consider updating to 3.3.5 or later to address the issue.

Defensive priority

Administrators should verify the plugin version and consider updating to 3.3.5 or later to address the issue.

Recommended defensive actions

• Verify plugin version
• Consider updating to 3.3.5 or later
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The evidence for this CVE is limited. The CVE record and NVD detail indicate that the Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address. Administrators should verify the plugin version and consider updating to 3.3.5 or later to address the issue. Additional verification tasks may be necessary to confirm affected scope and severity.

Official resources