easy-login-woocommerce Unauthenticated Account Takeover via Password Reset (CVE-2026-18468)

Vulnerability Overview Vulnerability Name: Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header Description: The plugin does not bind the password reset verification state to the account being reset or the party completing the verification; instead, it binds it to a client-controlled value. This allows unauthenticated attackers to take over the accounts of any users who recently completed the reset verification, including administrators. Conditions for Exploitation: A non-default verification code reset mode must be enabled. Once a password is set, the state is not consumed, allowing account takeover to be repeated from a single victim's verification within a day. Scope Affected Plugin: easy-login-woocommerce Fixed Version: 4.0.2 Remediation Fixed Version: Upgrade to version 4.0.2 or higher. Additional Information CVE ID: CVE-2026-18468 Classification: - Type: AUTHBYPASS - OWASP Top 10: A2: Broken Authentication and Session Management - CWE: CWE-287 - CVSS: 8.1 (High) Original Researcher: Artus KG Submitter: Artus KG Twitter: @artuskg Validated: Yes WPVDB ID: 0b567954-4bcc-4e2a-a2b5-024175012a19 Timeline: - Public Date: 2026-08-05 - Added Date: 2026-08-05 - Last Updated: 2026-08-07 References CVE-2026-18468 Related Vulnerabilities JobSearch <= 2.3.4 - Authentication Bypass to Account Takeover (2024-08-12) ZM Ajax Login & Register <= 2.0.2 - Unauthenticated Authentication Bypass (2023-04-14) WP Marketplace <= 2.4.0 - Arbitrary File Download (2015-03-21) Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities (2020-02-06) Jobmonster < 4.8.2 - Authentication Bypass (2025-10-30) Proof of Concept (POC) Code POC Code: The page states that the POC will be revealed on 2026-09-10 to allow users time to update. Currently, no specific POC code is provided on the page.

Goal Reached Thanks to every supporter — we hit 100%!

easy-login-woocommerce Unauthenticated Account Takeover via Password Reset (CVE-2026-18468)

More from this source