Login & Register Forms CVE-2026-14836

The Login & Register Forms plugin's verification-code-based password reset mode must be explicitly enabled in the plugin settings - this is a non-default configuration distinct from the standard WordPress core password reset mechanism, and this is reflected in the CVSS AC:H rating. The attacker must also know or enumerate the target account's username or registered email address to initiate a reset. No authentication is required and no victim interaction is needed once a target account is identified. Limiting factors: the non-default mode requirement reduces the realistic attack surface to sites that have deliberately configured this flow; brute-force success depends on verification code entropy and network throughput, though the rate-limit bypass removes the primary automated defense; and the attacker must maintain sustained network access throughout the code enumeration cycle.

The NVD CVSS score of 8.1 (High) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H is reasonable: AC:H correctly reflects that the vulnerable code path requires the non-default verification-code reset mode to be enabled, reducing the exposed population. EPSS at 0.14% (4th percentile) indicates very low observed automated exploitation at the time of analysis, consistent with the non-default configuration dependency. However, a publicly available exploit code (reported by WPScan) materially lowers the skill barrier, and the impact ceiling - administrator account takeover on WordPress - is severe. These signals are not contradictory: the low EPSS likely reflects limited target population (sites with the specific mode enabled), not low exploitability once a target is identified. CISA KEV status is not confirmed. Net assessment: lower population exposure than a universal-default flaw, but any affected site faces near-certain compromise if targeted by an attacker using the available PoC.

An unauthenticated attacker targets a WordPress site running the Login & Register Forms plugin with verification-code reset mode enabled, initiating a password reset for a known administrator account. By cycling the client-controlled key value after each failed attempt, the attacker continuously resets the rate-limit counter and systematically brute-forces the verification code space. A publicly available proof-of-concept automates this process; once the correct code is submitted, the attacker sets a new password and achieves full administrative control of the WordPress site.