WordPress Login Forms Plugin Unbound Password Reset Verification

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Login & Register Forms WordPress plugin before version 4.0.2 contains a critical authentication bypass vulnerability (CWE-287) in its password reset mechanism. The flaw stems from the plugin's failure to bind password reset verification tokens to the specific user account or the entity performing the verification. Instead, it keys the verification state on a client-controlled value, enabling attackers to hijack password reset flows for any user—including administrators—who recently initiated account recovery. This vulnerability has a CVSS score of 8.1 and affects any WordPress installation using this plugin, making it a high-priority patch for organizations relying on this authentication component.

Casky's 283 mapped security skills leverage Claude AI's reasoning capabilities to detect the attack patterns behind this vulnerability across two critical MITRE ATT&CK tactics: Initial Access (TA0004) and Credential Access (TA0006). Practitioners using Casky would identify suspicious indicators such as password reset requests followed by unexpected account access from anomalous IP addresses, rapid sequential verification attempts using manipulated client-side tokens, and unauthorized administrative actions immediately following password recovery events. The platform's extended reasoning helps security teams recognize the authentication state bypass pattern—where attackers exploit the client-controlled verification mechanism to validate resets for accounts they don't own—and correlate these attack chains to potential account takeover incidents before damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18468.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-18468

Casky has 283 skills that investigate the attack patterns behind CVE-2026-18468. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn