WordPress Login Forms Plugin Password Reset Bypass

The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-18469 is a critical authentication bypass vulnerability in the Login & Register Forms WordPress plugin (versions before 4.0.2) that undermines password reset security. The flaw stems from keying both the verification code and attempt-rate limiting on client-controlled data rather than server-derived values, enabling attackers to reset brute-force protections at will. This affects any WordPress site running the vulnerable plugin with verification-code reset mode enabled, putting administrator accounts at direct risk of unauthorized takeover. The CVSS score of 8.1 reflects the severity: unauthenticated attackers can compromise high-privilege accounts without requiring valid credentials or user interaction.

Casky's 283 mapped security skills leverage Claude's extended reasoning to detect the attack patterns behind this vulnerability across MITRE ATT&CK tactics TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would observe findings flagging suspicious password reset request patterns—including rapid verification-code submissions from the same source with artificially reset attempt counters, inconsistent server-side rate-limit enforcement, and client-parameter manipulation in authentication flows. The platform's skill set identifies the CWE-287 (Improper Authentication) root cause by detecting when rate-limiting logic depends on user-supplied values rather than server state, and correlates these indicators with account takeover behaviors typical of credential access attacks, helping teams distinguish between legitimate password recovery and active exploitation attempts.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-18469.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-18469

Casky has 283 skills that investigate the attack patterns behind CVE-2026-18469. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn