CVE-2026-18470 in Login & Register Forms Plugin
Summary
by MITRE • 08/10/2026
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability in the Login & Register Forms WordPress plugin affects versions prior to 4.0.2 and represents a critical security flaw that undermines user authentication mechanisms and exposes sensitive information. This issue stems from inadequate verification processes during password reset requests, creating a pathway for attackers to enumerate valid user accounts without proper authorization. The flaw specifically targets the plugin's handling of password recovery functionality, where the system fails to validate that reset requests originate from legitimate account owners.
The technical implementation of this vulnerability allows unauthenticated attackers to submit password reset requests for any registered user account within the WordPress installation. When such requests are processed, the plugin returns email addresses associated with those accounts in its response without proper sanitization or access control measures. This behavior effectively enables account enumeration attacks where malicious actors can systematically test usernames and obtain corresponding email addresses through automated scripts that parse the plugin's responses.
From a security perspective, this vulnerability directly violates multiple principles of secure authentication design. The lack of proper verification mechanisms means that attackers can exploit the password reset functionality as an information disclosure vector, potentially gathering intelligence about valid user accounts including administrative ones. This information can then be used to mount targeted attacks such as credential stuffing, brute force attempts, or social engineering campaigns against specific users within the WordPress installation.
The operational impact of this vulnerability extends beyond simple information disclosure, as it provides attackers with valuable reconnaissance data that significantly increases their attack surface. When administrators' email addresses are exposed through this mechanism, it creates opportunities for more sophisticated attacks including phishing campaigns and targeted credential compromise attempts. The vulnerability also demonstrates poor input validation and response handling practices that could potentially lead to additional security issues if exploited in combination with other weaknesses.
Security standards such as CWE-200 (Information Exposure) and CWE-352 (Cross-Site Request Forgery) are directly applicable to this vulnerability, as it exposes sensitive information through improper access controls and lacks adequate request validation mechanisms. The ATT&CK framework categorizes this behavior under T1566 (Phishing) and T1589 (Compromise Credentials) where the initial reconnaissance phase is facilitated by the ability to enumerate valid email addresses without authentication requirements.
Mitigation strategies should focus on implementing proper authentication verification for password reset requests, ensuring that all account recovery functionality requires legitimate ownership verification before processing any requests. The plugin must be updated to version 4.0.2 or later where these vulnerabilities have been addressed through improved validation mechanisms and secure response handling. Additionally, administrators should implement rate limiting for password reset requests to prevent automated enumeration attacks and consider additional security measures such as CAPTCHA implementations for account recovery functions. Network-level monitoring should also be deployed to detect unusual patterns of password reset request activity that may indicate attempted exploitation of this vulnerability.