CVE-2026-18468: WordPress Login Forms Auth Bypass Flaw

CVE-2026-18468 Overview

CVE-2026-18468 affects the Login & Register Forms WordPress plugin in versions prior to 4.0.2. The plugin fails to bind the password reset verification state to the account being reset or to the party that completed the verification. Instead, the verification state is keyed on a value the client controls. Unauthenticated attackers can take over the account of any user who recently completed a reset verification, including administrator accounts. The flaw is categorized under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can hijack administrator accounts on affected WordPress sites, resulting in full site compromise.

Affected Products

Login & Register Forms WordPress plugin versions before 4.0.2
WordPress sites using the plugin's password reset workflow
Administrator accounts that recently completed a password reset verification

Discovery Timeline

2026-08-10 - CVE-2026-18468 published to the National Vulnerability Database
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18468

Vulnerability Analysis

The vulnerability resides in the password reset workflow of the Login & Register Forms plugin. The reset process requires a user to complete a verification step before submitting a new password. The plugin tracks whether verification was completed, but it does not associate that state with a specific account or the session that performed the verification.

Because verification state is keyed on a client-controlled value, an attacker can submit a password change request referencing another user's account after any legitimate user completes a reset verification. The server accepts the request and updates the target account's password. Attackers do not need credentials, tokens, or user interaction from the victim.

Root Cause

The root cause is improper authentication logic in the reset endpoint. The plugin trusts a client-supplied identifier to determine which account is being reset. It also fails to scope the verified state to the account or to the requesting party. This produces a broken authentication boundary that allows cross-account password changes.

Attack Vector

The attack is remote and unauthenticated. An attacker monitors or waits for any user to initiate a password reset and complete verification on a vulnerable site. The attacker then sends a crafted password reset submission that references the target account, typically an administrator username or email. The server processes the request as if the verification applied to the attacker-supplied account. Attack complexity is elevated because the attacker must time the request against a legitimate verification event, but no authentication or user interaction is required.

No public proof-of-concept code is available. Refer to the WPScan Vulnerability Report for additional technical details.

Detection Methods for CVE-2026-18468

Indicators of Compromise

Password change events for administrator accounts without a matching authenticated session in web server logs
Reset-related POST requests to the Login & Register Forms plugin endpoints referencing user identifiers that differ from the verifying session
Successful administrator logins from IP addresses not previously associated with the account following a password reset event
Unexpected email notifications to users indicating password changes they did not initiate

Detection Strategies

Review WordPress audit logs for password change events on high-privilege accounts and correlate them with the originating IP and session
Alert on repeated reset submissions targeting different account identifiers from the same IP within a short window
Compare user account email addresses and metadata against historical baselines to identify unauthorized modifications following reset activity

Monitoring Recommendations

Enable WordPress audit logging plugins to capture user profile changes, password resets, and role modifications
Forward WordPress and web server logs to a central analytics platform for correlation with authentication events
Monitor for new administrator sessions immediately following reset verification activity on any account

How to Mitigate CVE-2026-18468

Immediate Actions Required

Update the Login & Register Forms plugin to version 4.0.2 or later on all WordPress sites
Force a password reset for all administrator and privileged accounts after patching
Review recent password change events and administrator logins for signs of unauthorized takeover
Rotate WordPress secret keys and salts in wp-config.php to invalidate existing sessions

Patch Information

The vendor addressed the flaw in version 4.0.2 of the Login & Register Forms plugin. The fix binds the password reset verification state to the target account and the verifying session, preventing cross-account reuse of verification. See the WPScan Vulnerability Report for release details.

Workarounds

Disable the Login & Register Forms plugin until it can be upgraded to version 4.0.2
Restrict access to WordPress reset endpoints using a web application firewall rule that blocks unauthenticated password change submissions
Enforce multi-factor authentication on administrator accounts to reduce the impact of a stolen password

bash

# Configuration example
# Update the plugin using WP-CLI
wp plugin update login-and-register-forms --version=4.0.2

# Verify installed version
wp plugin get login-and-register-forms --field=version