Summary
CVE-2026-18469 is an improper authentication vulnerability (CWE-287) in the Login & Register Forms WordPress plugin, affecting all versions from 3.2.5 up to (but not including) 4.0.2. The flaw allows unauthenticated attackers to bypass the password-reset attempt limit and brute-force the verification code used in the plugin’s password reset flow, leading to full account takeover, including administrator accounts. The issue carries a CVSS v3.1 base score of 8.1 (High).
Technical details
- Root cause: the plugin ties both the password-reset verification code and the per-source brute-force attempt counter to a client-controlled value instead of a server-derived one.
- Because the counter is keyed on attacker-supplied data, an attacker can reset the attempt counter at will simply by changing that client-controlled value, defeating the rate limit meant to prevent brute-forcing.
- Trigger condition: the plugin’s verification-code password reset mode must be enabled on the target site.
- Attack vector: network-based, no authentication or user interaction required (AV:N, PR:N, UI:N); attack complexity is rated high (AC:H), reflecting the need to brute-force the code even without the rate limit.
- This is described as a residual of an earlier issue fixed in version 3.2.5 — that prior fix moved the attacker-controlled value to a different client-supplied channel rather than eliminating the dependency on client-controlled data, leaving every release from 3.2.5 through 4.0.1 still exploitable.
- Impact: complete compromise of confidentiality, integrity, and availability, since a successful brute-force lets an attacker reset the password of and take over any account, including administrators.
Affected software
- Login & Register Forms WordPress plugin, versions 3.2.5 through 4.0.1 (all versions prior to 4.0.2).
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: upgrade the Login & Register Forms plugin to version 4.0.2 or later, which enforces the password-reset attempt limit against a server-derived value.
- If immediate patching is not possible, disable the verification-code password reset mode in the plugin’s settings to remove the exploitable code path until the update can be applied.
- Review WordPress user accounts, particularly administrator accounts, for signs of unauthorized password resets or logins, and rotate credentials as a precaution.