CVE-2026-18468 Auth bypass in Login & Register Forms
Unauthenticated attackers can take over any user account, including administrators, by exploiting a flaw in the password reset verification state handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18468?
CVE-2026-18468 is a high-severity authentication bypass vulnerability in Unknown Login & Register Forms, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
Weakness: CWE-287
Which versions are affected by CVE-2026-18468?
How do I fix CVE-2026-18468?
No fix has been published for CVE-2026-18468 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18468 being exploited?
There is no known exploitation of CVE-2026-18468 in the wild and no public exploit code.
Sources
Also known as GHSA-77w2-vfvm-8c9g.