# CVE-2026-18356: Limit Login Attempts Reloaded username denylist bypass via case variant and email

Source: https://junglewise.ai/threats/cve-2026-18356-limit-login-attempts-reloaded-username-denylist-bypass-via-case  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18356 · Severity: low · CVSS 3.7 · Published 2026-08-21

Limit Login Attempts Reloaded is a WordPress plugin that blocks login attempts from specific usernames to prevent unauthorized access to admin accounts. A flaw in the plugin's security checks allows an attacker who already knows the password for a denylisted account to bypass the login block by using a different case variant of the username or by logging in with the account's email address instead. This defeats the administrator's intended protection without requiring any knowledge of additional credentials.

Vendors: [WebFactory Ltd](https://junglewise.ai/threats/vendors/webfactory-ltd).

## Quick answers

**Is CVE-2026-18356 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18356 being exploited in the wild.

**How severe is CVE-2026-18356?** Low severity, with a CVSS score of 3.7, published 21 August 2026.

**Which products and versions are affected?** WebFactory Ltd Limit Login Attempts Reloaded before 3.3.5.

**Is there a fix for CVE-2026-18356?** A patch was published on 2026-08-21: Version 3.3.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18356 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18356?** Check whether you run WebFactory Ltd Limit Login Attempts Reloaded at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a logic flaw in the username denylist comparison mechanism. The plugin fails to perform case-insensitive comparisons when checking logins against the denylist, and does not account for authentication via the associated email address. An attacker with valid credentials for a denylisted account can bypass the block by submitting "Victimadmin" instead of "victimadmin" (single-site installations) or by submitting the account's email address (both single-site and multisite). The attack requires pre-existing knowledge of the account password, meaning it defeats the intended administrative control rather than granting unauthorized access. The flaw was patched in version 3.3.5 with case-insensitive comparison and email-based filtering logic.

## Affected products

- WebFactory Ltd Limit Login Attempts Reloaded before 3.3.5

## Timeline

- 2026-08-17: disclosed
- 2026-08-21: advisory
- 2026-08-21: patched: Version 3.3.5 released

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/](https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/)