CVE-2026-118439

MediumCVSS 4.1/10Last modified Nov 11, 2026

Description

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
UnknownLimit Login Attempts Security< 3.4.2

References

Timeline

Published
Nov 11, 2026
Last modified
Nov 11, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-118444.9The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a Arbitrary File Read vulnerability, allowing privileged remCVE-2026-1184444.8Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nCVE-2026-1184456.9A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expoCVE-2026-1184466.9A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND arrayCVE-2026-1184474.8A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. TCVE-2026-1184486.9A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, iCVE-2026-118457.2The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has a OS Command Injection vulnerability, allowing privileged reCVE-2026-1184505.9Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged user may create filesCVE-2026-1184588.1The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixCVE-2026-1184596.3A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credenCVE-2026-118468.1The  iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authentiCVE-2026-1184608.0Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, ena
CVE-2026-118439: Medium severity, CVSS 4.1 | Vulnix