CVE-2026-18468 — HIGH (8.1)

Vulnerability Description

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.

CVSS Score

8.1

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Related Weaknesses (CWE)

CWE-287

References

https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/

FAQ

What is CVE-2026-18468?

CVE-2026-18468 is a vulnerability with a CVSS score of 8.1 (HIGH). The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it inst...

How severe is CVE-2026-18468?

CVE-2026-18468 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-18468?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.