CVE-2026-14836: Login & Register Forms Auth Bypass Flaw

CVE-2026-14836 Overview

CVE-2026-14836 affects the Login & Register Forms WordPress plugin in versions before 3.2.5. The plugin fails to enforce rate limiting on its password-reset verification-code flow. Both the verification code and the per-source attempt counter are keyed on an unauthenticated, client-controlled value. Unauthenticated attackers can reset the counter at will and brute-force the verification code. When the verification-code reset mode is enabled, this leads to full account takeover, including administrator accounts. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can brute-force password-reset verification codes and take over any WordPress account, including administrators.

Affected Products

Login & Register Forms WordPress plugin versions before 3.2.5
WordPress sites with the verification-code password-reset mode enabled
All WordPress installations using vulnerable versions of the plugin

Discovery Timeline

2026-08-01 - CVE-2026-14836 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-14836

Vulnerability Analysis

The vulnerability resides in the password-reset verification-code flow of the Login & Register Forms plugin. The plugin issues a verification code to authorize password resets and applies a per-source attempt counter to limit brute-force attempts. Both values are indexed against an identifier supplied by the client in the request. Because that identifier is unauthenticated and attacker-controlled, the plugin cannot distinguish between legitimate reset sessions and adversarial ones. Attackers can rotate the identifier to zero the counter between guesses. This defeats the rate-limit control entirely and reduces verification-code recovery to a brute-force search.

Root Cause

The root cause is improper authentication combined with a broken rate-limit design [CWE-287]. The plugin trusts client-supplied input as the key for its throttling logic. State that must be integrity-protected on the server is instead derived from the request. As a result, attackers control the throttling namespace and can reset it arbitrarily.

Attack Vector

An unauthenticated attacker initiates the password-reset flow for a target account, including an administrator. The attacker submits guesses against the verification-code endpoint. Between guesses, the attacker modifies the client-controlled key value to reset the attempt counter. Once the correct code is guessed, the attacker sets a new password and gains full access to the account. Refer to the WPScan Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-14836

Indicators of Compromise

High volume of password-reset verification requests targeting the same user account within short time windows.
Repeated POST requests to the plugin's verification-code endpoint with varying client-supplied identifier values.
Unexpected administrator password changes without corresponding legitimate reset activity in audit logs.
New administrator sessions originating from unfamiliar IP addresses shortly after reset attempts.

Detection Strategies

Alert on repeated failed verification-code submissions against the same WordPress account.
Correlate password-reset events with subsequent administrator logins from new source IPs or user agents.
Monitor web server logs for anomalous request rates against Login & Register Forms plugin endpoints.

Monitoring Recommendations

Enable WordPress audit logging for password-reset events and administrator role changes.
Deploy a web application firewall rule to rate-limit requests to the plugin's verification endpoint by source IP.
Forward WordPress and web server logs to a centralized SIEM for correlation and long-term analysis.

How to Mitigate CVE-2026-14836

Immediate Actions Required

Update the Login & Register Forms plugin to version 3.2.5 or later on all WordPress sites.
Disable the verification-code reset mode until the plugin is patched if updates cannot be applied immediately.
Audit administrator accounts for unauthorized password changes or new sessions.
Force password rotation for all privileged WordPress accounts as a precaution.

Patch Information

The vendor addressed the flaw in Login & Register Forms plugin version 3.2.5. Administrators should upgrade through the WordPress plugin manager or by replacing the plugin files. Details are available in the WPScan Vulnerability Report.

Workarounds

Disable the verification-code password-reset mode in plugin settings until patching is complete.
Restrict access to WordPress password-reset endpoints using IP allow-listing where feasible.
Enforce multi-factor authentication on all administrator accounts to reduce impact of credential compromise.

bash

# Update the plugin via WP-CLI
wp plugin update login-and-register-forms --version=3.2.5

# Verify installed version
wp plugin get login-and-register-forms --field=version