{"affected":[{"defaultStatus":"unaffected","product":"Limit Login Attempts Security","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"3.4.2","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118439","cwes":["CWE-918"],"description":"The Limit Login Attempts Security  WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF).","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/9f7a9969-354c-4b9e-b56f-d832d89741b5/"}],"kev":null,"metrics":[],"modifiedAt":1794376809024,"publishedAt":1794376809024,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/9f7a9969-354c-4b9e-b56f-d832d89741b5/"}],"remediation":[],"revision":"3b53f4e916de87576481907940ed38ee43bec555d07467498770e400f4b17b35","sources":[{"modifiedAt":1794376809024,"name":"CNA: WPScan","retrievedAt":1794377376055,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118439"}],"ssvc":null,"status":"published","title":"Limit Login Attempts Reloaded < 3.4.2 - Admin+ SSRF via App Setup Code","updatedAt":1794377376055}