Improper Rate Limiting in Login & Register Forms Plugin by WordPress
CVE-2026-14836
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 1 August 2026
Badges
What is CVE-2026-14836?
The Login & Register Forms plugin for WordPress prior to version 3.2.5 features a serious security issue where the rate limit enforcement on password-reset verification codes can be manipulated. Specifically, the plugin lets unauthorized users control a key component used for verifying password-reset requests, thereby allowing them to reset the attempt counters at will. This significant oversight allows attackers to potentially brute-force the verification code, risking unauthorized access to any user account within the system, including those of administrators when the verification reset feature is activated.
Affected Version(s)
Login & Register Forms 0 < 3.2.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.