CVE-2026-18469
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
The Login & Register Forms WordPress plugin before version 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
Risk Assessment
Attackers can take over user accounts, including administrators, potentially leading to full site compromise.
Recommendation
Update the Login & Register Forms plugin to version 4.0.2 or later, which includes fixes for attempt limit enforcement and secure verification state storage.
Other vulnerabilities in Login & Register Forms
See all- CVE-2026-18470High
The Login & Register Forms WordPress plugin before version 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response. This allows unauthenticated users to obtain registered users' email addresses, including administrators'.
- CVE-2026-18468High
The Login & Register Forms WordPress plugin before version 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls. This allows unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Original NVD description (English source)
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.