A critical authentication bypass vulnerability in the Login & Register Forms WordPress plugin allows unauthenticated attackers to perform account takeovers.

This is an improper authentication vulnerability (CWE-287) where the plugin fails to bind the password reset verification state to a specific account. An unauthenticated attacker can manipulate client-controlled values to reset another user's password, provided the plugin's non-default verification-code reset mode is active.

Successful exploitation results in full account takeover, granting attackers unauthorized access to sensitive user data, administrative functions, or protected resources within the WordPress environment. With a CVSS score of 8.1, this represents a high-severity risk that could lead to widespread credential compromise and significant reputational damage if user accounts are hijacked at scale.

Immediate Action: Update the Login & Register Forms plugin to version 4.0.2 or later immediately to resolve the authentication state management flaw.

Proactive Monitoring: Review web server access logs for unusual patterns involving password reset requests or unexpected account modifications.

Compensating Controls: If an immediate update is not feasible, consider disabling the plugin or reverting to standard WordPress authentication methods until the patch can be deployed. A Web Application Firewall may also be configured to block suspicious requests directed at the plugin's reset verification endpoint.

Public Exploit Available: No (As of Aug 10, 2026, there is no confirmed public exploit available).

Given the potential for unauthorized account access, administrators should prioritize updating to version 4.0.2 across all affected WordPress instances. This vulnerability demonstrates the risks inherent in non-standard authentication implementations, and applying the vendor-provided patch is the only reliable method to eliminate the risk of account takeover.