8.1
High
CVE-2026-18468 The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the…
Description
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Login & Register Forms 3.2 | 3.2.5 → < 4.0.2 | 4.0.2 |
Other CVEs of Login & Register Forms
The 4 CVEs of Login & Register Forms →
CVE-2026-18470
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the…
7.5
High
CVE-2026-18469
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a…
8.1
High
CVE-2026-14836
The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset…
8.1
High