PatchSiren

Limit Login Attempts Reloaded CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

LOW Limit Login Attempts Reloaded CVE published 2026-08-21

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway. This issue may allow unauthorized access to WordPress installations using the vulnerable plugin. The vulnerability is clas [truncated]