UNKNOWN NVD

CVE-2026-18470

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately

The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.

References

https://wpscan.com/vulnerability/589b7661-4a0d-4041-8c29-2819d8b1e402/

Published: 2026-08-10 · Source: NVD · Feed updated: 2026-08-10

This unknown severity vulnerability was published on 2026-08-10 via NVD.

vulnfeed aggregates 9044 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.