Executive brief
A vulnerability in the Login/Signup Popup plugin for WordPress allows unauthorized individuals to take over any user account, including administrator accounts. The plugin fails to properly limit the number of attempts someone can make when guessing a password-reset code, and it allows attackers to reset the security counter at will. This could lead to a complete compromise of the website, theft of customer data, and loss of operational control.
Technical details
The vulnerability is an authentication bypass caused by an improper rate limit implementation in the password-reset verification-code flow. The plugin keys both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value. This allows a remote, unauthenticated attacker to reset the attempt counter at will, facilitating a brute-force attack against the verification code. If the verification-code reset mode is enabled, an attacker can successfully take over any account, including those with administrative privileges. The issue is fixed in version 3.2.5.
Affected products
- Unknown Login/Signup Popup (easy-login-woocommerce) < 3.2.5
Timeline
- 2026-07-17: disclosed
- 2026-07-17: advisory: WPScan advisory published
- 2026-08-01: patched: NVD publication date; fix available in 3.2.5