Login & Register Forms plugin leaks admin email addresses via reset endpoint
Unauthenticated users can retrieve any registered user's email address, including admins, via the password reset endpoint. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 5.3
- EPSS (exploit probability)
- 0.4%
- Status
- patched
- Published
Is CVE-2026-18470 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-18470 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-11-13 snapshot. That can change quickly; check the write-up below for the latest reporting.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.4% (scored October 14, 2026).
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-13. Full cross-catalog view: /kev-comparison
CVE-2026-18470 timeline
- First 0dayNews coveragesame day as NVD
- Published to NVD
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account’s owner and does not adequately redact the address returned in its response. Unauthenticated users can obtain registered users’ email addresses — including administrators’ — by interacting with the reset endpoint.
This flaw serves as the recon step in a three-CVE chain alongside CVE-2026-18469 and CVE-2026-18468 that together enable unauthenticated admin account takeover.
Fix: Update to version 4.0.2.
Source: WPScan
Other Login & Register Forms CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-18469 Login & Register Forms plugin rate limit bypass enables reset code brute-forcewrite-up | [ CRITICAL ] | 9.8 | 0.4% | — |
| CVE-2026-18468 Login & Register Forms plugin reset state binding flaw enables account takeoverwrite-up | [ CRITICAL ] | 9.8 | 0.4% | — |
