8.1
Élevée
CVE-2026-18468 The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the…
Description
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Login & Register Forms 3.2 | 3.2.5 → < 4.0.2 | 4.0.2 |
Autres CVE de Login & Register Forms
Les 4 CVE de Login & Register Forms →
CVE-2026-18470
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the…
7.5
Élevée
CVE-2026-18469
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a…
8.1
Élevée
CVE-2026-14836
The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset…
8.1
Élevée