CVE-2026-18356: WordPress Limit Login Attempts Reloaded Username Denylist Bypass via Case Variant

Vulnerability Overview Vulnerability Name: Limit Login Attempts Reloaded < 3.3.5 - Username Denylist Bypass via Case Variant and Account Email Description: The plugin does not perform a case-insensitive comparison when checking the login against the username denylist, nor does it account for the account's email address. This allows an account, which an administrator intended to block, to authenticate via its email address. Impact: This vulnerability affects sites where administrators have populated the local username denylist (which is empty by default). Exploiting this vulnerability requires already possessing valid credentials for a blacklisted account; therefore, it circumvents the administrator's intended block rather than granting unauthorized access to those without passwords. Case-sensitive routing applies to single-site installations; on multisite installations, WordPress normalizes the submitted login, leaving only email-based routing. Affected Range Affected Plugin: Plugin Name: limit-login-attempts-reloaded Fixed Version: 3.3.5 Remediation Fixed Version: 3.3.5 Additional Information CVE ID: CVE-2026-18356 Original Researcher: Artus KG Submitter: Artus KG Twitter: artuskg Verification Status: Yes WPVDB ID: fbcf5a9a-f204-49b8-aa80-748a8a7b5245 Release Timeline: Public Release: 2026-08-17 Added: 2026-08-17 Last Updated: 2026-08-17 Related Vulnerabilities Events Made Easy < 3.1.2 - Unauthenticated Payment Bypass Formidable Forms < 6.32.1 - Unauthenticated Payment Bypass via PayPal APPROVAL_PENDING Subscription Status Login Block IPs <= 1.0.0 - IP Spoofing Bypass Zero Spam < 5.5.7 - Spam Protection Bypass Download Monitor < 1.6.4 - Authenticated Directory Listing Proof of Concept (PoC) PoC Code:

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18356: WordPress Limit Login Attempts Reloaded Username Denylist Bypass via Case Variant

More from this source