CVE-2026-118439
MEDIUM
NVD
CVSS Score
4.1
Severity
MEDIUM
Published
Nov 11, 2026
Vendor
unknown
Description
The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).