Vulnerability in Login & Register Forms

CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to…

Affected products

  • Unknown Login & Register Forms — versions 3.0.0

References