Login & Register Forms plugin rate limit bypass enables reset code brute-force
Client-controlled rate-limit key on password reset codes lets unauthenticated attackers brute-force the code to take over any account, including admins. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 9.8
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-18469 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-18469 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-18469 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value. Both the verification code and the per-source attempt counter are keyed on a value the client controls, allowing unauthenticated attackers to reset the limit at will and brute-force the reset verification code to take over any account — including administrators — when the plugin’s verification-code reset mode is enabled.
This is the brute-force step in a three-CVE chain alongside CVE-2026-18470 (email disclosure) and CVE-2026-18468 (state binding bypass) that together enable unauthenticated admin account takeover.
Fix: Update to version 4.0.2.
Source: WPScan
Other Login & Register Forms CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-18470 Login & Register Forms plugin leaks admin email addresses via reset endpointwrite-up | [ MEDIUM ] | 5.3 | 0.4% | — |
| CVE-2026-18468 Login & Register Forms plugin reset state binding flaw enables account takeoverwrite-up | [ CRITICAL ] | 9.8 | 0.4% | — |
