Login & Register Forms CVE-2026-18469

Exploitation requires that the Login & Register Forms plugin's 'verification-code reset mode' is explicitly enabled - this is the precise configuration gate described in the CVE. Without this mode active, the vulnerable code path is not reachable and the site is not exposed regardless of plugin version. The CVSS vector PR:N and UI:N confirm that no authentication and no victim interaction are needed once the condition is met. The main limiting factors are: (1) the non-default plugin configuration (verification-code reset mode must be on), (2) the plugin must be installed and active on the target site, and (3) AC:H reflects that successfully brute-forcing the code requires the attacker to identify and manipulate the client-controlled key correctly, as described in the WPScan PoC. No platform restriction applies - any WordPress installation meeting the above conditions is vulnerable.

The provided CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects a high-severity issue: fully unauthenticated, network-reachable, with complete compromise potential. AC:H is appropriate because the 'verification-code reset mode' must be enabled - a non-default configuration that meaningfully limits the exposed population. In contrast, EPSS at 0.15% (4th percentile) signals that exploitation has not been observed at scale, likely because the vulnerable configuration is not universally deployed. This is not a contradiction: the existence of a WPScan-published PoC elevates the practical risk for sites that do have the feature enabled, even if the global exploitation rate is low. The vulnerability is not in CISA KEV, confirming no confirmed mass-exploitation campaign at time of analysis. The real-world priority is therefore conditional: sites running this plugin with verification-code reset mode enabled should treat this as urgent given the PoC availability and full-impact potential; sites without that mode are not exposed.

An unauthenticated attacker enumerates a WordPress site running Login & Register Forms with verification-code reset mode enabled, then initiates a password-reset request for the administrator account. By cycling the client-controlled key used to index the attempt counter, the attacker resets the brute-force lockout after each failed guess and iterates through the verification code space without restriction; a publicly available WPScan PoC codifies this technique. Successful code submission triggers a password reset granting the attacker full administrative control of the WordPress installation.