EUVD-2026-55031
GHSA-53xf-4rjw-hxg5
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects the required non-default configuration (verification-code reset mode); PR:N confirmed by unauthenticated attack path; full C/I/A from admin account takeover.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.
AnalysisAI
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the Login & Register Forms plugin's 'verification-code reset mode' is explicitly enabled - this is the precise configuration gate described in the CVE. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) correctly reflects a high-severity issue: fully unauthenticated, network-reachable, with complete compromise potential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker enumerates a WordPress site running Login & Register Forms with verification-code reset mode enabled, then initiates a password-reset request for the administrator account. By cycling the client-controlled key used to index the attempt counter, the attacker resets the brute-force lockout after each failed guess and iterates through the verification code space without restriction; a publicly available WPScan PoC codifies this technique. … |
| Remediation | The primary fix is upgrading the Login & Register Forms plugin to version 4.0.2 or later, which is vendor-released and confirmed as the patch boundary per both WPScan (https://wpscan.com/vulnerability/be74144a-b45b-469f-8631-7fdca6d19a66/) and EUVD-2026-55031. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running the Login & Register Forms plugin and verify the version; if any are running versions prior to 4.0.2, either upgrade immediately to version 4.0.2 or later, or disable the verification-code reset mode setting as interim protection. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Login Register Forms
View allAccount takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken pass
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attacker
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today