CVE-2026-18469: easy-login-woocommerce Unauthenticated Account Takeover via Password Reset Code Brute Force

Vulnerability Overview Vulnerability Name: Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force Description: The plugin does not enforce server-derived values to limit password reset attempts, instead relying on client-controlled data. This allows unauthenticated attackers to arbitrarily bypass these limits and brute-force verification codes, leading to account takeover (including admin accounts) when the verification code reset mode is enabled. CVE ID: CVE-2026-18469 Classification: - Type: AUTHBYPASS - OWASP Top 10: A2: Broken Authentication and Session Management - CWE: CWE-287 - CVSS: 8.1 (high) Affected Versions Affected Plugin: easy-login-woocommerce Fixed Version: 4.0.2 Remediation Fixed Version: Upgrade to version 4.0.2 or later. Timeline Public Disclosure Date: 2026-08-05 Added Date: 2026-08-05 Last Updated: 2026-08-07 Additional Information Original Researcher: ryan fabella Submitter: ryan fabella Verification Status: Yes WPVDB ID: be74144a-b45b-469f-8631-7fda6d19a66 Related Vulnerabilities UltimateAI < 2.8.3 - Limited User Password Reset Premium Packages < 7.0.5 - Authentication Bypass to Non-Admin via 'wpdmpdd' Parameter NEX Forms < 7.8.8 - Authentication Bypass for Excel Reports Checkout Mestres WP < 7.1.9.8 - Authentication Bypass via Password Reset Proof of Concept (POC) POC Code: The page states that the POC will be disclosed on 2026-09-10 to allow users time to update. No specific POC code is currently provided on the page. --- The above is a summary of key vulnerability information from the webpage screenshot.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18469: easy-login-woocommerce Unauthenticated Account Takeover via Password Reset Code Brute Force

More from this source