EUVD-2026-63912
GHSA-pr5g-gw8g-vfpm
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
AC:H because attacker must already hold credentials for a specifically denylisted account; C:L added since successful authentication exposes protected account data.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
AnalysisAI
Username denylist bypass in Limit Login Attempts Security (Limit Login Attempts Reloaded) before version 3.3.5 allows a WordPress user who has been explicitly blocked by an administrator to successfully authenticate by varying the case of their username or by supplying the account's associated email address instead. This is a logic flaw in the plugin's denylist enforcement, entirely defeating the access control that a site administrator intended to impose on specific accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess valid, working credentials - specifically, the password and either the username in a different case or the email address registered to the account - for a WordPress user that an administrator has placed on the plugin's denylist. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 3.7 with AC:H is technically accurate: an attacker must already possess valid, working credentials for a specifically denylisted account, which is an uncommon precondition in most attack models and sharply limits the population of exploitable scenarios. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Limit Login Attempts Security plugin to version 3.3.5 or later, which is the vendor-released patch confirmed by WPScan and EUVD-2026-63912. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-184 – Incomplete List of Disallowed Inputs
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today