Authentication Flaw in Login & Register Forms Plugin Affects WordPress Users
CVE-2026-18470
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18470?
The Login & Register Forms plugin for WordPress versions prior to 4.0.2 contains a significant security flaw that fails to confirm if a password reset request is initiated by the authorized account owner. This oversight permits unauthorized individuals to gain access to the email addresses of registered users, including those of administrators, jeopardizing user privacy and exposing sensitive information. Websites utilizing this plugin are urged to update to the latest version to mitigate this vulnerability.
Affected Version(s)
Login & Register Forms 3.0.0 < 4.0.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.