CVE-2026-18468
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Login & Register Forms WordPress plugin before version 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls. This allows unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Risk Assessment
Attackers can take over the account of a user who recently completed a password reset, potentially leading to unauthorized access to sensitive data and functions.
Recommendation
Update the Login & Register Forms plugin to version 4.0.2 or later, which includes fixes for binding verification state to the account and session.
Other vulnerabilities in Login & Register Forms
See all- CVE-2026-18470High
The Login & Register Forms WordPress plugin before version 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response. This allows unauthenticated users to obtain registered users' email addresses, including administrators'.
- CVE-2026-18469High
The Login & Register Forms WordPress plugin before version 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
Original NVD description (English source)
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.