Login Register Forms
Monthly
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. A publicly available proof-of-concept exploit exists; no CISA KEV confirmation has been issued, but the admin-takeover impact makes this a high-priority patch for any site running the affected configuration.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
Account takeover via broken password-reset rate limiting in the Login & Register Forms WordPress plugin (versions before 4.0.2) allows unauthenticated remote attackers to brute-force verification codes and seize any account, including administrator accounts. Both the verification code and the per-source attempt counter are keyed on client-controlled data, meaning an attacker can reset the rate limit at will by manipulating that value - rendering the lockout mechanism entirely ineffective. Exploitation requires the 'verification-code reset mode' to be enabled; a publicly available proof-of-concept from WPScan demonstrates the technique, though EPSS sits at only 0.15% (4th percentile), indicating limited observed exploitation activity to date.
Account takeover in the Login & Register Forms WordPress plugin (before 4.0.2) is enabled by a fundamentally broken password reset verification design: the plugin keys the 'verification completed' state to a client-controlled value rather than binding it server-side to the account under reset or to the authenticated session of the party completing verification. An unauthenticated attacker who can observe or manipulate this state during or after a legitimate reset flow can claim ownership of that completed verification and set a new password for any targeted account, including administrator accounts. A publicly available exploit has been published by WPScan, and no public exploit identified at time of analysis translates to KEV, though POC availability materially lowers the exploitation threshold.
Account takeover in the Login & Register Forms WordPress plugin (versions before 3.2.5) enables unauthenticated attackers to brute-force password-reset verification codes by bypassing the plugin's rate-limit control. The rate limiter and code storage are both keyed on a client-supplied value, meaning an attacker can arbitrarily reset their attempt counter and exhaust the verification code space, resulting in full compromise of any account - including site administrators - on affected WordPress installations. A publicly available proof-of-concept exploit exists; no CISA KEV confirmation has been issued, but the admin-takeover impact makes this a high-priority patch for any site running the affected configuration.