CVE-2026-14836

The WordPress plugin "Login & Register Forms" before version 3.2.5 has a vulnerability in its password reset feature. The plugin does not adequately limit the number of attempts an attacker can make to reset a verification code, allowing an unauthenticated user to repeatedly reset the limit and eventually brute-force their way into any account, including administrator accounts. This is because the verification code and the attempt counter are both tied to a value that can be controlled by the attacker.

Based on public CVE data (MITRE/NVD).