CVE-2026-14836

The Login & Register Forms WordPress plugin (versions before 3.2.5 ) contains an unauthenticated account takeover vulnerability. The flaw exists because the plugin fails to properly enforce rate limits during the password-reset verification-code flow . Specifically, it keys both the verification ...