CVE-2026-18356: Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
Affected Software
Event History
Frequently Asked Questions
Who is affected by this issue?
WordPress sites using Limit Login Attempts Reloaded versions earlier than 3.3.5 are affected if administrators rely on the plugin's username denylist to prevent specific accounts from logging in.
What does an attacker need to exploit the bypass?
The attacker must be able to authenticate using an account that an administrator intended to block. They can bypass the denylist by using a case variant of the username or the account's email address.
Does this affect the plugin's default configuration?
The issue is relevant when the username denylist is used to block an account. The provided information does not establish impact for deployments that do not use that denylist.
How can administrators remediate the issue?
Update Limit Login Attempts Reloaded to version 3.3.5 or later. Until updating, do not rely solely on its username denylist to prevent an account from authenticating.