CVE-2026-118439 · Package
NO FIX YET
The Limit Login Attempts Security WordPress plugin before 3.4.2 sends a server-side request to a destination taken from a setup value without checking it. A user with administrator rights can make the site request arbitrary hosts, including internal ones (SSRF).
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Limit Login Attempts Security WordPress plugin before 3.4.2. The attacker needs an administrator account on the site, so the risk is mainly from untrusted or compromised admin users; sites that already restrict admin accounts carry less exposure.
Not affected if no-untrusted-admins, plugin-version-3.4.2-or-later
Who cares self-hosted, wordpress
wp plugin get limit-login-attempts-reloaded --field=version if WP-CLI is available.Unknown from the sources.
The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.