Password Reset Bypass Vulnerability in Login & Register Forms for WordPress
CVE-2026-18469
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
What is CVE-2026-18469?
The Login & Register Forms plugin for WordPress prior to version 4.0.2 is susceptible to a password reset bypass vulnerability. This occurs due to the failure of the plugin to properly regulate the number of password reset attempts based on a secure, server-side value. Instead, it relies on client-side data, which an attacker can manipulate. This flaw provides unauthenticated attackers the ability to reset the count of password reset attempts at will, effectively allowing them to perform brute-force attacks on verification codes. If the verification code reset feature is enabled, attackers can take control of user accounts, including those of administrators.
Affected Version(s)
Login & Register Forms 3.2.5 < 4.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.