The Login & Register Forms plugin for WordPress is affected by an information exposure vulnerability that exposes sensitive data to unauthenticated remote attackers.

The plugin suffers from an information exposure flaw (CWE-200) that permits unauthenticated users to access data they should not be able to view, as confirmed by the CVSS vector's PR:N (Privileges Required: None) attribute.

Successful exploitation allows unauthorized parties to harvest sensitive information, potentially leading to user account compromise or further reconnaissance of the WordPress environment. With a CVSS score of 7.5, this high severity vulnerability poses a significant risk to data confidentiality and integrity.

Immediate Action: Update the Login & Register Forms plugin to version 4.0.2 or higher immediately to resolve the security flaw.

Proactive Monitoring: Review web server access logs for unusual request patterns targeting plugin-specific paths or unexpected data retrieval sequences.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules designed to identify and block unauthorized access attempts to plugin endpoints until the update is applied.

Public Exploit Available: Unknown.

Given the high CVSS score and the existence of a proof-of-concept, administrators should prioritize updating this plugin immediately. Failure to patch exposes the host application to unauthorized data access, which could be leveraged for more complex attacks against the underlying WordPress installation.