Description
The Limit Login Attempts Reloaded WordPress plugin before 3.3.5 does not compare logins against its username denylist case-insensitively and does not account for the account's email address, allowing an account an administrator intended to block from logging in to authenticate anyway.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Limit Login Attempts Security | < 3.3.5 | 3.3.5 |
References
- https://wpscan.com/vulnerability/fbcf5a9a-f204-49b8-aa80-748a8a7b5245/ exploit vdb-entry technical-description