CVE-2026-18470: WordPress Login & Register Forms Plugin

CVE-2026-18470 Overview

CVE-2026-18470 is an information disclosure vulnerability in the Login & Register Forms WordPress plugin prior to version 4.0.2. The plugin fails to verify that a password reset request originates from the account owner. It also does not adequately redact the email address returned in its response. Unauthenticated attackers can enumerate registered users' email addresses, including those belonging to administrators. The flaw is categorized under [CWE-200] Information Exposure and affects confidentiality of account data on any WordPress site running a vulnerable plugin version.

Critical Impact
Unauthenticated remote attackers can harvest email addresses of registered users, including administrators, enabling targeted phishing and credential-based follow-on attacks.

Affected Products

Login & Register Forms WordPress plugin versions before 4.0.2
WordPress sites with the vulnerable plugin installed and active
Administrator accounts registered on affected sites

Discovery Timeline

2026-08-10 - CVE-2026-18470 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-18470

Vulnerability Analysis

The Login & Register Forms plugin exposes a password reset endpoint that accepts requests without verifying the requester's identity or ownership of the target account. When an attacker submits a reset request referencing a target user, the server response contains the account's email address without adequate redaction. This design flaw converts a routine account recovery workflow into an unauthenticated user enumeration primitive.

Attackers can iterate through usernames or user IDs to extract email addresses for every registered account. Administrator accounts are particularly valuable targets because their addresses can be used to craft spear-phishing campaigns aimed at credential theft or session hijacking. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network.

Root Cause

The root cause is twofold. First, the plugin does not authenticate or authorize the password reset request against the account owner. Second, the response body leaks the associated email address rather than returning a generic acknowledgment. Both defects violate standard secure design for account recovery flows, where reset endpoints must return uniform responses regardless of whether the target account exists.

Attack Vector

Exploitation occurs over HTTP against the plugin's password reset endpoint. An unauthenticated attacker submits crafted reset requests referencing target usernames or identifiers, then parses each response to extract the disclosed email address. Automation allows enumeration of the full user directory. Technical details are documented in the WPScan Vulnerability Report.

// No verified proof-of-concept code is published.
// See the WPScan advisory for reproduction details.

Detection Methods for CVE-2026-18470

Indicators of Compromise

High volume of requests to the plugin's password reset endpoint from a single source IP address
Sequential or scripted requests referencing multiple usernames or user IDs in a short time window
Password reset requests originating from IP ranges with no prior authenticated activity on the site
Follow-on phishing emails targeting harvested administrator addresses

Detection Strategies

Inspect web server access logs for repeated POST requests to WordPress password reset URLs handled by the plugin
Correlate reset request volume with unique username or user ID parameters to identify enumeration behavior
Deploy a web application firewall rule that flags password reset responses containing full email addresses
Alert on unusual outbound response payload sizes from the plugin endpoint

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized analysis platform
Track failed and successful password reset events for baseline deviation
Monitor administrator inboxes for phishing attempts referencing valid account context
Review plugin version inventory across all managed WordPress deployments on a recurring cadence

How to Mitigate CVE-2026-18470

Immediate Actions Required

Upgrade the Login & Register Forms plugin to version 4.0.2 or later on every affected WordPress site
Audit administrator and privileged accounts for signs of targeted phishing after upgrade
Enforce multi-factor authentication on all WordPress administrator accounts to blunt credential-based follow-on attacks
Rotate passwords for accounts whose email addresses may have been exposed

Patch Information

The plugin maintainers released version 4.0.2 to address CVE-2026-18470. The fix restricts password reset requests to authorized flows and redacts email addresses from server responses. Refer to the WPScan Vulnerability Report for advisory details and version confirmation.

Workarounds

Deactivate and remove the Login & Register Forms plugin until version 4.0.2 or later can be installed
Block or rate-limit the plugin's password reset endpoint at the web application firewall or reverse proxy
Restrict access to WordPress login and registration pages by source IP where operationally feasible
Configure the WordPress reverse proxy to strip email address strings from unauthenticated reset responses

bash

# Example rate-limit rule for the WordPress login endpoint (nginx)
limit_req_zone $binary_remote_addr zone=wp_reset:10m rate=5r/m;

location = /wp-login.php {
    limit_req zone=wp_reset burst=5 nodelay;
    proxy_pass http://wordpress_backend;
}