Description

The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-08-21T12:16:24.863Z",
  "pubdate": "2026-08-21T12:16:24.863Z",
  "executiveSummary": "The Limit Login Attempts Reloaded WordPress plugin contains an authentication restriction bypass vulnerability resulting from improper input validation and case sensitivity handling within its security controls. Specifically, versions prior to 3.3.5 fail to perform case-insensitive comparisons against the configured username denylist and neglect to evaluate the associated account email address during authentication attempts. This security deficiency allows unauthorized users or blocked entities, specifically administrators intended to be restricted, to successfully bypass login blocks and authenticate into the application. The impact of this vulnerability includes unauthorized access to privileged accounts, potential compromise of administrative functions, and circumvention of implemented security access policies. The risk implication is elevated due to the direct failure of access control mechanisms designed to prevent unauthorized authentication. Attacker capabilities involve leveraging variations in username casing or utilizing alternative identifiers such as account email addresses to evade security filters. Exploitation requirements necessitate the attacker possessing knowledge of a targeted account's alternative casing or email address, alongside standard network access to the application's authentication interface.",
  "technicalDetails": "The root cause of the vulnerability lies in the flawed logic implemented within the username denylist validation routines of the Limit Login Attempts Reloaded WordPress plugin. During the authentication evaluation process, the application checks submitted login credentials against a predefined list of blocked usernames. However, the comparison mechanism performs strict case-sensitive checks instead of normalizing input data to a uniform case format. Consequently, an account identifier blocked under a specific case configuration (e.g., Administrator) can be accessed by submitting the credential with altered casing (e.g., administrator). Furthermore, the security control fails to resolve or evaluate the target account's registered email address during the blocklist verification phase. Because authentication mechanisms often permit users to authenticate using either a username or an email address, an attacker or restricted administrator can bypass the username-based denylist entirely by supplying the account's associated email address as the login identifier. The vulnerable component is the authentication validation and denylist enforcement logic within the plugin. The affected versions comprise all installations of the Limit Login Attempts Reloaded WordPress plugin prior to version 3.3.5. The attack flow proceeds as follows: First, the security administrator configures the plugin's denylist to block a specific username. Second, an authenticated or unauthenticated attacker identifies that the blocking mechanism relies solely on exact string matches of the configured username. Third, the attacker initiates an authentication request against the WordPress login interface using either a casing variation of the blocked username or the primary email address linked to the targeted account. Fourth, the plugin's flawed validation routine fails to recognize the input as belonging to the denylisted entity due to the lack of case normalization and email address correlation. Fifth, the authentication request passes the plugin's security checks and is forwarded to the underlying WordPress core authentication system. Sixth, the system validates the credentials and successfully authenticates the user, granting unauthorized access to the restricted account. No special privileges are required to attempt the bypass, and the attack vector is exploitable remotely over the network via standard HTTP/HTTPS authentication interfaces. The post-exploitation impact includes full compromise of the affected account, which may lead to administrative takeover of the WordPress site depending on the privilege level of the bypassed entity."
}