Login & Register Forms vulnerabilities

The Login & Register Forms WordPress plugin before version 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response. This allows unauthenticated users to obtain registered users' email addresses, including administrators'.

The Login & Register Forms WordPress plugin before version 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data. This allows unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

The Login & Register Forms WordPress plugin before version 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls. This allows unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.