Login & Register Forms plugin reset state binding flaw enables account takeover
Verified reset state is keyed on a client-controlled value, not bound to the target account. Unauthenticated attackers can hijack any recently-verified reset session. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification. The state is keyed instead on a value the client controls. Unauthenticated attackers can manipulate that value to take over the account of any user who recently completed a reset verification, including an administrator.
This is the account-takeover step in a three-CVE chain alongside CVE-2026-18470 (email disclosure) and CVE-2026-18469 (rate limit bypass) that together enable unauthenticated admin account takeover with no prior foothold.
Fix: Update to version 4.0.2.
Source: WPScan
