EUVD-2026-55032
GHSA-77w2-vfvm-8c9g
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible, unauthenticated attack with AC:H for required timing dependency; full account takeover yields C:H/I:H/A:H; scope unchanged within the WordPress installation boundary.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
AnalysisAI
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that a target user account has recently initiated and completed the email-based password reset verification step through the Login & Register Forms plugin - the attacker must act within the validity window of that verification state. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) captures the severity accurately: full CIA impact with no authentication or user interaction required, but the AC:H constraint is meaningful - exploitation depends on a target account having an active or recently completed password reset in progress, introducing a timing dependency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a WordPress site running the vulnerable plugin and either waits for or induces a target user (such as a site administrator) to initiate a password reset. Once the target completes the email verification step, the attacker submits a crafted request with a manipulated client-controlled verification state value, claiming the completed verification as their own. … |
| Remediation | Upgrade the Login & Register Forms WordPress plugin to version 4.0.2 or later, which is the vendor-released patch addressing the broken reset verification binding. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all WordPress installations running Login & Register Forms plugin and document current versions deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Login Register Forms
View allAccount takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attacker
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today