CVE-2026-118439: Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code
Published Nov 11, 2026
·Updated
The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).
Affected Software
1 affected component
Limit Login Attempts Reloaded Limit Login Attempts Reloaded WordPress plugin<3.4.2
Event History
Nov 11, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user with administrator privileges can exploit it by supplying a setup value that causes the plugin to make a server-side request.
2
What systems could be reached through the vulnerable site?
The vulnerable site can be induced to send requests to arbitrary hosts, including internal hosts that may not be directly reachable by the administrator.
3
Are installations running version 3.4.2 affected?
No. The issue affects versions of the plugin before 3.4.2.