CVE-2026-118439
Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).
| Vendor | unknown |
| Product | limit login attempts security |
| Published | Nov 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown limit login attempts security
Be the first to know when new unknown vulnerabilities affecting unknown limit login attempts security are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Limit Login Attempts Security
0 < 3.4.2
References
Credits
Viktor Heiduck WPScan