EUVD-2026-55030
GHSA-gxm4-76w3-xhp8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network request to the reset endpoint leaks email addresses with no integrity or availability impact, confirming AV:N/PR:N/C:H/I:N/A:N.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
Articles & Coverage 1
AnalysisAI
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special configuration is required beyond network access to a WordPress site running Login & Register Forms version 3.0.0 through 4.0.1 with the plugin active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.5 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects that exploitation requires no authentication, no user interaction, and no special access, making it technically trivial to abuse at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the Login & Register Forms plugin by inspecting page source or HTTP response headers. They submit a series of crafted password reset requests targeting known or guessed usernames; the plugin's response returns insufficiently redacted email addresses for each account, including the site administrator. … |
| Remediation | Update the Login & Register Forms WordPress plugin to version 4.0.2 or later, which is the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/589b7661-4a0d-4041-8c29-2819d8b1e402/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify whether the affected Login & Register Forms plugin is active and determine which versions are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Login Register Forms
View allAccount takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken pass
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attacker
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today