CVE-2026-18356: Limit Login Attempts Reloaded Auth Bypass

CVE-2026-18356 Overview

CVE-2026-18356 affects the Limit Login Attempts Reloaded WordPress plugin in versions before 3.3.5. The plugin performs case-sensitive comparisons against its username denylist and ignores the account's email address during authentication checks. An attacker can log in to an account that an administrator explicitly intended to block by altering the case of the username or by authenticating with the associated email address. The flaw maps to [CWE-184: Incomplete List of Disallowed Inputs] and produces a limited integrity impact on affected WordPress sites.

Critical Impact
Accounts administrators added to the login denylist can still authenticate through case variation or email-based login, undermining the plugin's blocking control.

Affected Products

Limit Login Attempts Reloaded WordPress plugin versions prior to 3.3.5
WordPress sites relying on the plugin's username denylist to block specific accounts
Environments allowing login by email address in addition to username

Discovery Timeline

2026-08-21 - CVE-2026-18356 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18356

Vulnerability Analysis

The Limit Login Attempts Reloaded plugin lets administrators define a denylist of usernames that must not be permitted to authenticate. The pre-3.3.5 implementation compares submitted credentials to this list using a case-sensitive string match. A denylist entry for admin therefore fails to match logins for Admin, ADMIN, or aDmIn. WordPress core normalizes usernames on account creation, but the authentication filter in the plugin does not apply the same normalization when enforcing the denylist.

The plugin also inspects only the username field. WordPress supports authentication by email address through wp_authenticate. When a user submits the account's email, the plugin's denylist check does not resolve the email to the underlying user account, so the blocked identity authenticates successfully.

Root Cause

The root cause is an incomplete denylist implementation. The plugin trusts the raw login string rather than resolving it to the canonical WP_User object before comparison. Both the case-insensitivity gap and the missing email lookup stem from validating the input surface instead of the authenticated identity.

Attack Vector

Exploitation requires network access to the WordPress login endpoint and knowledge of a denylisted account's username or email. The attacker submits credentials using a different letter case for the username, or supplies the account's email address, and the plugin permits the authentication attempt to proceed. Successful login still requires valid credentials, which limits the practical impact to scenarios where the attacker already possesses working credentials that an administrator attempted to revoke through the denylist.

No verified proof-of-concept code is published. See the WPScan Vulnerability Report for the technical write-up.

Detection Methods for CVE-2026-18356

Indicators of Compromise

Successful WordPress authentication events for usernames whose lowercased form matches an entry in the plugin's denylist
Successful logins using the email address of an account that appears on the denylist
Unexpected wp_login events for accounts administrators believed were blocked from access

Detection Strategies

Query WordPress authentication logs and correlate user_login values against the plugin's denylist using case-insensitive matching to surface bypass attempts
Correlate wp_authenticate_user events with the email addresses of denylisted accounts to detect email-based logins
Alert on any successful authentication for an account flagged as blocked in plugin configuration

Monitoring Recommendations

Forward WordPress and web server access logs to a centralized analytics platform and retain login events for review
Track the installed version of limit-login-attempts-reloaded across managed sites and flag hosts running versions below 3.3.5
Review plugin configuration exports periodically to confirm denylist entries remain in effect after updates

How to Mitigate CVE-2026-18356

Immediate Actions Required

Update the Limit Login Attempts Reloaded plugin to version 3.3.5 or later on all WordPress installations
Rotate credentials for any account currently listed on the plugin's denylist, since those accounts may have authenticated despite the block
Audit the WordPress users table and remove or disable accounts that should no longer have access, rather than relying solely on the plugin denylist

Patch Information

The vendor fixed the issue in Limit Login Attempts Reloaded version 3.3.5. The update normalizes username comparisons and accounts for email-based login when enforcing the denylist. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Delete or set the user_status of blocked accounts to disabled at the WordPress level instead of relying on the plugin denylist
Change the passwords of denylisted accounts to long random values to prevent authentication until a patched version is deployed
Restrict access to wp-login.php and xmlrpc.php by IP allowlist at the web server or WAF layer while the patch is rolled out

bash

# Update the plugin via WP-CLI on each affected site
wp plugin update limit-login-attempts-reloaded --version=3.3.5
wp plugin list --name=limit-login-attempts-reloaded --fields=name,status,version