What is CVE-2026-18356?

CVE-2026-18356 is a low-severity vulnerability in Limit Login Attempts Security, classified under Incomplete List of Disallowed Inputs. CVSS score: 3.7/10. Published 2026-08-21.

How severe is CVE-2026-18356?

Low severity. CVSS v3 base score is 3.7 out of 10.

Vulnerability in Limit Login Attempts Security

CVE-2026-18356

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

CVSS v3 metric

CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Unknown Limit Login Attempts Security

Weakness classification (CWE)

CWE-184 — Incomplete List of Disallowed Inputs

References

contact@wpscan.com (technical-description, exploit, vdb-entry)

Frequently asked questions

What is CVE-2026-18356?: CVE-2026-18356 is a low-severity vulnerability in Limit Login Attempts Security, classified under Incomplete List of Disallowed Inputs. CVSS score: 3.7/10. Published 2026-08-21.
How severe is CVE-2026-18356?: Low severity. CVSS v3 base score is 3.7 out of 10.