Login & Register Forms: Unauthenticated email enumeration (CVE-2026-18470)
An unauthenticated information exposure vulnerability in the WordPress Login & Register Forms plugin (easy-login-woocommerce) allows remote email enumeration when configured in verification-code mode.
CVE search metadata
CVE search record: CVE-2026-18470. Severity: high. CVSS: 7.5. EPSS: 0.43%. KEV: no. Product: Login & Register Forms (easy-login-woocommerce) (< 4.0.2). Brief: Login & Register Forms: Unauthenticated email enumeration (CVE-2026-18470). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-18470/
Triage facts
Revision 1- Applicability
- Login & Register Forms (easy-login-woocommerce) (< 4.0.2)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 09:05 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- B3Likely
CVE-2026-18470 is an information exposure vulnerability (CWE-200) affecting the WordPress "Login & Register Forms" plugin (easy-login-woocommerce) versions prior to 4.0.2. The flaw is triggered when the lost-password flow is configured to use "verification-code mode" (non-default). In this state, the application echoes the account email address in the response to unauthenticated password reset requests for valid usernames.
Impact
Successful exploitation allows an unauthenticated attacker to enumerate valid email addresses associated with user accounts on the target site. This information can be leveraged for downstream spearphishing or account takeover attempts.
Recommendation
- Update the "Login & Register Forms" plugin to version 4.0.2 or later immediately.
- If immediate patching is not possible, revert the lost-password flow configuration to the default link-based reset mode.
- Audit existing WordPress instances to identify systems running vulnerable versions (< 4.0.2).
Immediate actions
Patch Login & Register Forms plugin to 4.0.2 or higher
Threat Hunt
Identify high-frequency POST requests to the lost-password reset endpoint originating from single IP addresses
Data: Web server access logs
Mitigations
Change lost-password flow to default link-based mode
CVE-2026-18470