Three CVEs Chain to Admin Takeover in WordPress Login Plugin

Three CVEs, one plugin, one chain. Result: unauthenticated admin account takeover on any WordPress site running Login & Register Forms before 4.0.2.

Patch is out. Version 4.0.2 fixes all three.

The Three CVEs

CVE-2026-18470 — Medium (CVSS 5.3)

Email address disclosure via the password reset endpoint. No authentication required. The plugin returns registered users’ email addresses — including administrators’ — without adequate redaction and without verifying the requester owns the account. WPScan advisory.

Confidence: confirmed against NVD.

CVE-2026-18469 — Critical (CVSS 9.8)

The verification-code attempt limit on password resets is keyed on a client-controlled value, not a server-derived one. Attackers can reset that counter at will. Brute-force of the reset verification code is unrestricted when the plugin’s verification-code reset mode is enabled. WPScan advisory.

Confidence: confirmed against NVD.

CVE-2026-18468 — Critical (CVSS 9.8)

After a user completes reset verification, the resulting “verified” state is keyed on a client-controlled value rather than bound to the target account or the verifying party. Unauthenticated attackers can manipulate that value and take over any account whose owner recently completed a reset verification — including administrators. WPScan advisory.

Confidence: confirmed against NVD.

The Chain

18470 surfaces admin email addresses. 18469 removes the brute-force guardrail on verification codes. 18468 decouples the verified state from the actual account. Combined: unauthenticated takeover of any account on the site — including admin — with no prior foothold required.

What to Do

Update to Login & Register Forms 4.0.2. All three issues are fixed in this release.

No confirmed active exploitation as of publication — unconfirmed. That window is typically short after public disclosure. Not on 4.0.2 yet? Take the plugin offline. An unauthenticated full-admin takeover path isn’t a “patch at next maintenance window” situation.

Also check: today’s WPScan batch included dozens of additional WordPress plugin CVEs. If you haven’t audited plugin update queues recently, now is a good time.

Authentication bypass chains in WordPress plugins are a recurring pattern — compare Ash Framework’s auth bypass (CVE-2026-69659) disclosed last week, which reached admin-level access via a different state-management gap. Same class of failure, different codebase.

Browse all WordPress plugin vulnerabilities on this site. Track actively-exploited issues on the KEV tracker.