Login & Register Forms CVE-2026-18470

No special configuration is required beyond network access to a WordPress site running Login & Register Forms version 3.0.0 through 4.0.1 with the plugin active. The vulnerable password reset endpoint is exposed by default whenever the plugin is enabled, requires no authentication (CVSS PR:N), and involves no user interaction (CVSS UI:N). The attack is not restricted to a specific platform or non-default deployment mode. The practical limiting factor is that the attacker must identify the target site as running this specific plugin, which is easily detectable via page source inspection or plugin fingerprinting tools; exploitation impact is bounded to email address disclosure and does not directly enable account takeover or code execution without additional attacker steps.

The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects that exploitation requires no authentication, no user interaction, and no special access, making it technically trivial to abuse at scale. However, the impact is scoped entirely to information disclosure - specifically email address enumeration - rather than code execution or system compromise, which tempers urgency relative to RCE-class vulnerabilities sharing the same score. EPSS at 0.16% (5th percentile) indicates that despite a publicly available POC, widespread automated exploitation has not yet materialized; even a mid-sized municipal IT team in mielec should treat this as a near-term patching priority given the ease of exploitation and the reconnaissance value of harvested admin email addresses for follow-on phishing campaigns. The vulnerability does not appear in the CISA KEV catalog at time of analysis, confirming no confirmed active exploitation. The POC's existence and near-zero attack complexity significantly lower the barrier for opportunistic attackers, elevating practical risk above what the raw EPSS figure alone suggests.

An attacker identifies a WordPress site running the Login & Register Forms plugin by inspecting page source or HTTP response headers. They submit a series of crafted password reset requests targeting known or guessed usernames; the plugin's response returns insufficiently redacted email addresses for each account, including the site administrator. A publicly available POC automates this enumeration process, enabling rapid harvesting of the full registered user email list without any credentials or user interaction.