Unrated severityNVD Advisory· Published Nov 11, 2026

CVE-2026-118439

Description

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).

Affected products

WordPress/Limit Login Attempts Securityinferred2 versions
<3.4.2+ 1 more
- (no CPE)range: <3.4.2
- (no CPE)range: <3.4.2
Package: https://wordpress.org/plugins/limit-login-attempts-security

Patches

Vulnerability mechanics

References

wpscan.com/vulnerability/9f7a9969-354c-4b9e-b56f-d832d89741b5/nvd

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000