CVE-2026-18469
N/A
N/A
Summary
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Login & Register Forms | 3.2.5 < 4.0.2 | affected |
Weaknesses
- CWE-287 Improper Authentication
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.