{"id":"CVE-2026-118439","kind":"vulnerability","aliases":["CVE-2026-118439"],"related":[],"title":"Limit Login Attempts WordPress plugin: admins can make the site request internal hosts","description":"The Limit Login Attempts Security  WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.2 sends a server-side request to a destination taken from a setup value without checking it. A user with administrator rights can make the site request arbitrary hosts, including internal ones (SSRF).","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["no-untrusted-admins","plugin-version-3.4.2-or-later"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get limit-login-attempts-reloaded --field=version` if WP-CLI is available.\n- Confirm whether any setup value triggers outbound requests on the site.","fix":null,"status":"open","published_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","triaged_at":"2026-11-11T06:27:41+00:00","updated_at":"2026-11-11T06:27:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-11T06:27:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Limit Login Attempts Security WordPress plugin to `3.4.2` or later.","reach":"network","title":"Limit Login Attempts WordPress plugin: admins can make the site request internal hosts","impact":"medium","summary":"The Limit Login Attempts Security WordPress plugin before 3.4.2 sends a server-side request to a destination taken from a setup value without checking it. A user with administrator rights can make the site request arbitrary hosts, including internal ones (SSRF).","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Site makes requests to internal hosts, exposing internal services","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get limit-login-attempts-reloaded --field=version` if WP-CLI is available.\n- Confirm whether any setup value triggers outbound requests on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-3.4.2-or-later","no-untrusted-admins"],"who_is_affected":"Sites running the Limit Login Attempts Security WordPress plugin before 3.4.2. The attacker needs an administrator account on the site, so the risk is mainly from untrusted or compromised admin users; sites that already restrict admin accounts carry less exposure.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4541,"output_tokens":555,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-118439':16A,19A '-2026':15A,18A '3.4.2':33B,75C 'admin':6A 'administr':54B,98C 'allow':95C 'arbitrari':61B,107C 'attempt':3A,28B,70C 'built':87C 'check':49B 'cve':14A,17A 'destin':42B,80C 'host':13A,23B,62B,108C 'includ':63B,109C 'intern':12A,64B,110C 'issu':104C 'limit':1A,26B,68C 'login':2A,27B,69C 'make':8A,57B,101C 'one':65B,111C 'packag':20B 'plugin':5A,31B,73C 'privileg':99C 'request':11A,39B,60B,86C,105C 'right':55B 'secur':29B,71C 'self':22B 'self-host':21B 'send':34B 'server':37B,84C 'server-sid':36B,83C 'setup':46B,93C 'side':38B,85C 'site':10A,59B,103C 'ssrf':66B,112C 'suppli':92C 'taken':43B 'user':52B,91C,96C 'user-suppli':90C 'valid':78C 'valu':47B,94C 'without':48B 'wordpress':4A,24B,30B,72C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Limit Login Attempts Security WordPress plugin before 3.4.2. The attacker needs an administrator account on the site, so the risk is mainly from untrusted or compromised admin users; sites that already restrict admin accounts carry less exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-118439':16A,19A '-2026':15A,18A 'admin':6A 'attempt':3A 'cve':14A,17A 'host':13A 'intern':12A 'limit':1A 'login':2A 'make':8A 'plugin':5A 'request':11A 'site':10A 'wordpress':4A","search_b":"'3.4.2':33B 'administr':54B 'arbitrari':61B 'attempt':28B 'check':49B 'destin':42B 'host':23B,62B 'includ':63B 'intern':64B 'limit':26B 'login':27B 'make':57B 'one':65B 'packag':20B 'plugin':31B 'request':39B,60B 'right':55B 'secur':29B 'self':22B 'self-host':21B 'send':34B 'server':37B 'server-sid':36B 'setup':46B 'side':38B 'site':59B 'ssrf':66B 'taken':43B 'user':52B 'valu':47B 'without':48B 'wordpress':24B,30B","search_c":"'3.4.2':75C 'administr':98C 'allow':95C 'arbitrari':107C 'attempt':70C 'built':87C 'destin':80C 'host':108C 'includ':109C 'intern':110C 'issu':104C 'limit':68C 'login':69C 'make':101C 'one':111C 'plugin':73C 'privileg':99C 'request':86C,105C 'secur':71C 'server':84C 'server-sid':83C 'setup':93C 'side':85C 'site':103C 'ssrf':112C 'suppli':92C 'user':91C,96C 'user-suppli':90C 'valid':78C 'valu':94C 'wordpress':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T06:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118439","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118439","severity":null,"published_at":"2026-11-11T06:17:15+00:00","modified_at":"2026-11-11T06:17:15+00:00","first_seen_at":"2026-11-11T06:25:41+00:00","fetched_at":"2026-11-11T06:25:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}