Login & Register Forms lets visitors reset the password-code rate limit
Login & Register Forms before 3.2.5 keys both its password-reset verification code and per-source attempt counter to an unauthenticated value controlled by the requester. When verification-code reset mode is enabled, an unauthenticated attacker can continually change that value to reset the rate limit, brute-force the code for a selected account and reset its password, including for an Administrator. The record does not disclose the reset endpoint, client-controlled key, code parameter or verification function.
- Component
- Login & Register Forms
- Plugin slug
login-register-forms- Affected
- < 3.2.5
- Safe version
3.2.5- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Login & Register Forms to 3.2.5 or later. Disable verification-code password resets until updated, review reset traffic for rapidly changing client keys and repeated codes, invalidate affected sessions, reset credentials, and investigate administrator activity if takeover may have occurred.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.