CVE Record
[ MEDIUM ] CVE-2026-18470
Login & Register Forms plugin leaks admin email addresses via reset endpoint
Unauthenticated users can retrieve any registered user's email address, including admins, via the password reset endpoint. Fixed in 4.0.2.
- Vendor
- Login & Register Forms
- Product
- Login & Register Forms WordPress Plugin
- CVSS
- 5.3
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account’s owner and does not adequately redact the address returned in its response. Unauthenticated users can obtain registered users’ email addresses — including administrators’ — by interacting with the reset endpoint.
This flaw serves as the recon step in a three-CVE chain alongside CVE-2026-18469 and CVE-2026-18468 that together enable unauthenticated admin account takeover.
Fix: Update to version 4.0.2.
Source: WPScan
