Login & Register Forms plugin reset state binding flaw enables account takeover
Verified reset state is keyed on a client-controlled value, not bound to the target account. Unauthenticated attackers can hijack any recently-verified reset session. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-18468 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-18468 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-18468 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification. The state is keyed instead on a value the client controls. Unauthenticated attackers can manipulate that value to take over the account of any user who recently completed a reset verification, including an administrator.
This is the account-takeover step in a three-CVE chain alongside CVE-2026-18470 (email disclosure) and CVE-2026-18469 (rate limit bypass) that together enable unauthenticated admin account takeover with no prior foothold.
Fix: Update to version 4.0.2.
Source: WPScan
Other Login & Register Forms CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-18470 Login & Register Forms plugin leaks admin email addresses via reset endpointwrite-up | [ MEDIUM ] | 5.3 | 0.4% | — |
| CVE-2026-18469 Login & Register Forms plugin rate limit bypass enables reset code brute-forcewrite-up | [ CRITICAL ] | 9.8 | 0.4% | — |
