CVE-2026-18470
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
The Login & Register Forms WordPress plugin before version 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response. This allows unauthenticated users to obtain registered users' email addresses, including administrators'.
Risk Assessment
Disclosure of user email addresses, including administrators', can be exploited for phishing or targeted social engineering attacks.
Recommendation
Update the Login & Register Forms plugin to version 4.0.2 or later, which includes fixes for owner verification and address redaction.
Other vulnerabilities in Login & Register Forms
See all- CVE-2026-18469High
The Login & Register Forms WordPress plugin before version 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
- CVE-2026-18468High
The Login & Register Forms WordPress plugin before version 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls. This allows unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Original NVD description (English source)
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.