25782 matches found
EUVD-2026-55032
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...
CVE-2026-18468
The Login & Register Forms WordPress plugin, in versions prior to 4.0.2 , is vulnerable to an unauthenticated account takeover . The root cause is that the plugin fails to bind the password reset verification state to the specific account being reset or the party completing the verification; inst...
CVE-2026-18468 Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...
CVE-2026-16298
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
CVE-2026-18030
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...
EUVD-2026-55038
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...
EUVD-2026-55035
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
CVE-2026-16299 Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
CVE-2026-16299
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
CVE-2026-18030 Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...
CVE-2026-18030 Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...
CVE-2026-16299: Improper Authentication
The Single Sign On For TNG WordPress plugin before 2.2.0 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
PT-2026-69352
Name of the Vulnerable Software and Affected Versions FoodBoxBooker versions prior to 1.0.7 Description Insufficient validation of password reset requests allows unauthenticated attackers to reset passwords for any user, including those with administrator privileges, potentially resulting in a...
CVE-2026-18468: Improper Authentication
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of...
CVE-2026-16298: Improper Privilege Management
The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover...
PT-2026-69371
Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description When the verification-code reset mode is enabled, the plugin fails to enforce password reset attempt limits using a server-derived value. Instead, it relies on client-controlled data f...
PT-2026-69342
Name of the Vulnerable Software and Affected Versions vitepos WordPress plugin versions prior to 3.6.0 Description The point-of-sale password-reset API does not perform a per-target authorization check. Additionally, the custom Outlet Manager role is granted excessive password-reset capabilities ...
PT-2026-69370
Name of the Vulnerable Software and Affected Versions Login & Register Forms versions prior to 4.0.2 Description An issue exists where the password reset verification state is not bound to the account being reset or the party completing the verification. Instead, the state is keyed on a value...
CVE-2026-18030: Missing Authorization
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including administrators, and take over their...
CVE-2026-14237: Improper Privilege Management
The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to res...