Login & Register Forms plugin rate limit bypass enables reset code brute-force
Client-controlled rate-limit key on password reset codes lets unauthenticated attackers brute-force the code to take over any account, including admins. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value. Both the verification code and the per-source attempt counter are keyed on a value the client controls, allowing unauthenticated attackers to reset the limit at will and brute-force the reset verification code to take over any account — including administrators — when the plugin’s verification-code reset mode is enabled.
This is the brute-force step in a three-CVE chain alongside CVE-2026-18470 (email disclosure) and CVE-2026-18468 (state binding bypass) that together enable unauthenticated admin account takeover.
Fix: Update to version 4.0.2.
Source: WPScan
