Description
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account-s owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users- email addresses, including administrators-.
CVSS 7.5EPSS 0.316%Risk 0.77
View source- Published
- 2026-08-10 07:16:50
- Last modified
- 2026-08-10 20:17:29
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N