Cpe:2.3:a:easy-Login-Woocommerce:login_and_register_forms:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aeasy-login-woocommercelogin_and_register_formswordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 05 Nov 2026 09:05:51 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgLogin & Register Forms: Unauthenticated email enumeration (CVE-2026-18470)https://feed.craftedsignal.io/briefs/2026-11-cve-2026-18470/Thu, 05 Nov 2026 09:05:51 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cve-2026-18470/An unauthenticated information exposure vulnerability in the WordPress Login & Register Forms plugin (easy-login-woocommerce) allows remote email enumeration when configured in verification-code mode.CVE-2026-18470 is an information exposure vulnerability (CWE-200) affecting the WordPress "Login & Register Forms" plugin (easy-login-woocommerce) versions prior to 4.0.2. The flaw is triggered when the lost-password flow is configured to use "verification-code mode" (non-default). In this state, the application echoes the account email address in the response to unauthenticated password reset requests for valid usernames.

Impact

Successful exploitation allows an unauthenticated attacker to enumerate valid email addresses associated with user accounts on the target site. This information can be leveraged for downstream spearphishing or account takeover attempts.

Recommendation

  • Update the "Login & Register Forms" plugin to version 4.0.2 or later immediately.
  • If immediate patching is not possible, revert the lost-password flow configuration to the default link-based reset mode.
  • Audit existing WordPress instances to identify systems running vulnerable versions (< 4.0.2).
]]>highadvisory