Description

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T07:16:50.270Z",
  "pubdate": "2026-08-10T07:16:50.270Z",
  "executiveSummary": "An information disclosure vulnerability exists in the Login & Register Forms WordPress plugin before version 4.0.2.\nThe vulnerability stems from insufficient validation of password reset requests and inadequate redaction of sensitive data within the server response.\nUnauthenticated threat actors can exploit this flaw to harvest registered users' email addresses, including high-privilege accounts such as administrators.\nThe primary impact is unauthorized reconnaissance, exposing user PII (Personally Identifiable Information) which can facilitate subsequent targeted attacks such as credential stuffing or social engineering campaigns.\nExploitation requires no prior authentication, specific privileges, or complex interaction, lowering the barrier to entry for external adversaries.\nRemediation requires updating the Login & Register Forms plugin to version 4.0.2 or later to ensure proper request verification and secure data redaction.",
  "technicalDetails": "The vulnerability resides within the password reset functionality of the Login & Register Forms WordPress plugin, affecting all versions prior to 4.0.2.\nThe root cause is twofold: the application logic fails to cryptographically or logically verify that a password reset request originates from the legitimate owner of the target account, and the response handling mechanism inadequately redacts the user's email address returned to the client.\nFrom a network exposure perspective, the vulnerable endpoint is publicly accessible over HTTP/HTTPS to any unauthenticated user.\nDuring exploitation, an unauthenticated attacker submits a crafted password reset request targeting known or guessed usernames within the WordPress environment.\nBecause the vulnerable component does not enforce strict ownership validation or restrict overly verbose error/success responses, the server processes the request and returns a payload containing the unredacted email address associated with the requested account.\nBy automating this process against enumerated user accounts, an attacker can rapidly compile a comprehensive list of valid email addresses tied to the system, specifically targeting administrator profiles for privilege escalation preparation.\nPost-exploitation impact includes successful reconnaissance that yields valid authentication identifiers, which can be leveraged in brute-force attacks, credential stuffing, or targeted phishing operations against administrative personnel."
}