CVE-2026-14836

The CVE concerns the WordPress plugin Login & Register Forms (vulnerable through version 3.2.4 and earlier) where the password-reset verification-code flow does not enforce the rate limit correctly. The issue stems from keying both the verification code and the per-source attempt counter on an un...