# CVE-2026-18468: WordPress Login & Register Forms account takeover via password reset

Source: https://junglewise.ai/threats/cve-2026-18468-wordpress-login-register-forms-account-takeover-via-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-10. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18468 · Severity: high · CVSS 8.1 · Published 2026-08-10

The Login & Register Forms WordPress plugin before 4.0.2 contains a critical flaw in its password reset feature that allows attackers to take over any user account, including administrator accounts, without knowing the original password. When the plugin is configured to use verification codes for password resets (a non-default mode), an unauthenticated attacker can reset another user's password by spoofing an IP address header, gaining immediate access to accounts including those with full administrative control over the website.

Technologies: [Wordpress Login & Register Forms](https://junglewise.ai/threats/technologies/login-register-forms). Vendors: [Wordpress](https://junglewise.ai/threats/vendors/wordpress).

## Quick answers

**Is CVE-2026-18468 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18468 being exploited in the wild.

**How severe is CVE-2026-18468?** High severity, with a CVSS score of 8.1, published 10 August 2026.

**Which products and versions are affected?** Wordpress Login & Register Forms 3.2.5 to 4.0.1.

**Is there a fix for CVE-2026-18468?** A patch was published on 2026-08-10: Version 4.0.2 fixes the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-18468 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-18468?** Check whether you run Wordpress Login & Register Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The plugin fails to bind password reset verification state to the user account or the authenticating party, instead keying it solely on the client-supplied IP address from the X-Real-IP or X-Forwarded-For headers. This allows an attacker who knows a victim's IP address (or can guess it) to bypass the verification code requirement and set a new password without ever receiving the emailed verification code. The vulnerability requires the non-default "Send Verification Code" reset mode to be enabled and affects versions 3.2.5 through 4.0.1. The verification state is never consumed after a password reset, making the attack repeatable for 24 hours from a single victim verification. Fixed in version 4.0.2.

## Affected products

- WordPress Login & Register Forms 3.2.5 to 4.0.1

## Timeline

- 2026-08-10: disclosed
- 2026-08-10: patched: Version 4.0.2 fixes the vulnerability

## References

- [https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/](https://wpscan.com/vulnerability/0b567954-4bcc-4e2a-a2b5-024175012a19/)

## Related threats

- [WordPress Login & Register Forms authentication bypass in password reset](https://junglewise.ai/threats/cve-2026-18469-wordpress-login-register-forms-authentication-bypass-in-password)