What is the CVSS score of CVE-2026-14836?

CVE-2026-14836 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Login & Register Forms are affected by CVE-2026-14836?

The WordPress Login & Register Forms plugin (versions before 3.2.5) is vulnerable to unauthenticated account takeover attacks that could grant attackers administrative control of affected sites.. A patch is available.

Is there a public PoC exploit available for CVE-2026-14836?

Yes, a public proof-of-concept exploit is available for CVE-2026-14836. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-14836?

Within 24 hours, identify WordPress installations running the Login & Register Forms plugin and upgrade to version 3.2.5 or later. Within 7 days, force password resets for all administrator and privileged accounts, and audit login history for unauthorized access attempts. Within 30 days, conduct a comprehensive security review of affected accounts and implement continuous monitoring for suspicious password-reset activity patterns.

Login & Register Forms CVE-2026-14836

EUVD-2026-51719 HIGH

Improper Authentication (CWE-287)

2026-08-01 WPScan

GHSA-79h9-6m37-f387

WordPress Authentication Bypass Login Register Forms

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Non-default mode required justifies AC:H; no credentials needed (PR:N); admin account takeover warrants C:H/I:H/A:H across all impact dimensions.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 17:38 vuln.today

CVSS changed

Aug 05, 2026 - 17:22 NVD

8.1 (HIGH)

Patch available

Aug 01, 2026 - 07:01 EUVD

CVE Published

Aug 01, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Aug 01, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

AnalysisAI

Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with vulnerable plugin and reset mode enabled

Delivery

Initiate password reset for target account (admin or user)

Exploit

Rotate client-controlled key to reset rate-limit counter

Execution

Brute-force verification code space iteratively

Persist

Submit valid code to authenticate reset

Impact

Set attacker-controlled password and achieve full account takeover

Access

Identify WordPress site with vulnerable plugin and reset mode enabled

Delivery

Initiate password reset for target account (admin or user)

Exploit

Rotate client-controlled key to reset rate-limit counter

Execution

Brute-force verification code space iteratively

Persist

Submit valid code to authenticate reset

Impact

Set attacker-controlled password and achieve full account takeover

Vulnerability AssessmentAI

Exploitation	The Login & Register Forms plugin's verification-code-based password reset mode must be explicitly enabled in the plugin settings - this is a non-default configuration distinct from the standard WordPress core password reset mechanism, and this is reflected in the CVSS AC:H rating. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD CVSS score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H is reasonable: AC:H correctly reflects that the vulnerable code path requires the non-default verification-code reset mode to be enabled, reducing the exposed population. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker targets a WordPress site running the Login & Register Forms plugin with verification-code reset mode enabled, initiating a password reset for a known administrator account. By cycling the client-controlled key value after each failed attempt, the attacker continuously resets the rate-limit counter and systematically brute-forces the verification code space. …
Remediation	Update the Login & Register Forms WordPress plugin to version 3.2.5 or later, which resolves the rate-limit bypass by anchoring both the verification code and the attempt counter to a server-controlled session identifier rather than a client-supplied value. … Detailed patch versions, workarounds, and compensating controls in full report.