An unauthenticated vulnerability in the Login & Register Forms plugin enables attackers to perform unlimited password reset attempts, posing a severe risk of unauthorized account takeover.

The plugin fails to validate password reset attempt limits against server side data, instead relying on client controlled input. This allows unauthenticated attackers to reset the attempt counter and brute force verification codes to compromise any user account, including administrators.

The vulnerability carries a CVSS score of 8.1, reflecting its high severity. Successful exploitation allows for full account takeover, which could lead to unauthorized data access, administrative privilege escalation, and significant reputational damage to the organization.

Immediate Action: Update the Login & Register Forms plugin to version 4.0.2 or later immediately.

Proactive Monitoring: Review authentication and password reset logs for unusual spikes in activity or repeated attempts from single source IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to rate limit access to the plugin's password reset endpoints.

Public Exploit Available: No (unknown).

Given the critical nature of account takeover vulnerabilities, organizations must prioritize updating the affected plugin immediately. Failure to apply the patch leaves systems exposed to credential stuffing and account hijacking attempts that can easily bypass standard security controls.