Account Takeover Vulnerability in Login & Register Forms Plugin by WordPress
CVE-2026-18468
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
What is CVE-2026-18468?
The Login & Register Forms plugin for WordPress before version 4.0.2 is susceptible to an account takeover vulnerability. This occurs when the password reset verification state is improperly managed, allowing unauthenticated attackers to exploit the vulnerability and gain unauthorized access to user accounts, including those of administrators. The flaw enables attackers to hijack accounts of users who have recently completed password reset verifications, posing a significant risk to the integrity and security of the affected accounts.
Affected Version(s)
Login & Register Forms 3.2.5 < 4.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.