CVE-2026-118439 Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code

The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones SSRF...

CVE-2026-118439

The Limit Login Attempts Security WordPress plugin, specifically versions prior to 3.4.2 , is vulnerable to Server-Side Request Forgery (SSRF) . The root cause is a failure to validate the destination of a server-side request constructed from a user-supplied setup value. This allows users with ad...