Login & Register Forms EUVD-2026-55032

Exploitation requires that a target user account has recently initiated and completed the email-based password reset verification step through the Login & Register Forms plugin - the attacker must act within the validity window of that verification state. The plugin's password reset feature must be enabled and publicly accessible on the WordPress site. The CVSS AC:H rating confirms this timing dependency as the primary constraint. No authentication is required from the attacker (CVSS PR:N), and no victim interaction is required beyond what the victim already did independently. What limits exploitation: the attacker must know or guess a target account identifier (typically a username or email), and the timing window is bounded by the verification token's validity period. This is not a default-off feature - sites using the plugin for user-facing login/registration would typically have password reset enabled.

The official CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the severity accurately: full CIA impact with no authentication or user interaction required, but the AC:H constraint is meaningful - exploitation depends on a target account having an active or recently completed password reset in progress, introducing a timing dependency. The EPSS score of 0.15% (4th percentile) is low, consistent with this AC:H timing requirement narrowing opportunistic exploitation; however, EPSS frequently lags POC publication, and the publicly available WPScan exploit means the practical barrier has already dropped. No CISA KEV listing is present at time of analysis, so confirmed widespread in-the-wild exploitation is not established. The administrator account scope is the critical amplifier: even a mid-sized municipal IT team in walbrzych should treat this as urgent because a single administrator account takeover on a WordPress site yields full site compromise. The gap between low EPSS and high CVSS/POC availability is not a contradiction but a signal of targeted rather than mass-exploitation risk.

An attacker identifies a WordPress site running the vulnerable plugin and either waits for or induces a target user (such as a site administrator) to initiate a password reset. Once the target completes the email verification step, the attacker submits a crafted request with a manipulated client-controlled verification state value, claiming the completed verification as their own. Because the server does not validate that the verification state belongs to the originating session or account, the attacker is permitted to set a new password for the administrator account, achieving full site compromise. A publicly available exploit from WPScan demonstrates this technique.