CVE-2026-18356

LowCVSS 3.7/10Last modified Oct 16, 2026

Description

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-184

Affected software

No affected versions have been published.

Timeline

Published
Aug 21, 2026
Last modified
Oct 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-183577.5The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting featuCVE-2026-183587.5A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled,CVE-2026-183598.5Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated uCVE-2026-18365.3The system stores the username and password from the login form after submitting the request. This could allow an attacker with access to thCVE-2026-183607.6The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes fCVE-2026-183617.6The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload fuCVE-2026-183625.9The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.CVE-2026-183639.1A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. DurinCVE-2026-183644.3The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users witCVE-2026-183654.3The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on one of its AJAX actions, allowing users with a CVE-2026-183669.8The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WoCVE-2026-183679.3A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS older than version 2
CVE-2026-18356: Low severity, CVSS 3.7 | Vulnix