CVE-2026-14836

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 3.2.5

Description When the verification-code reset mode is enabled, the plugin fails to properly enforce rate limits during the password-reset verification-code flow. The verification code and the per-source attempt counter are keyed on a value controlled by the client, which allows an unauthenticated attacker to reset the attempt limit and brute-force the code to take over any account, including those with administrator privileges.

Recommendations Update to version 3.2.5 or later.