CVE-2026-18470

Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2

Description The plugin fails to verify if a password reset request originates from the actual account owner. Additionally, it does not properly redact the address in the response, which enables unauthenticated users to retrieve the email addresses of registered users, including those with administrator privileges.

Recommendations Update to version 4.0.2 or later.