{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/login--register-forms-easy-login-woocommerce--4.0.2/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:easy-login-woocommerce:login_and_register_forms:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-18470"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Login \u0026 Register Forms (easy-login-woocommerce) (\u003c 4.0.2)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eCVE-2026-18470 is an information exposure vulnerability (CWE-200) affecting the WordPress \u0026quot;Login \u0026amp; Register Forms\u0026quot; plugin (\u003ccode\u003eeasy-login-woocommerce\u003c/code\u003e) versions prior to 4.0.2. The flaw is triggered when the lost-password flow is configured to use \u0026quot;verification-code mode\u0026quot; (non-default). In this state, the application echoes the account email address in the response to unauthenticated password reset requests for valid usernames.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to enumerate valid email addresses associated with user accounts on the target site. This information can be leveraged for downstream spearphishing or account takeover attempts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the \u0026quot;Login \u0026amp; Register Forms\u0026quot; plugin to version 4.0.2 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, revert the lost-password flow configuration to the default link-based reset mode.\u003c/li\u003e\n\u003cli\u003eAudit existing WordPress instances to identify systems running vulnerable versions (\u0026lt; 4.0.2).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-05T09:05:51Z","date_published":"2026-11-05T09:05:51Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-18470/","summary":"An unauthenticated information exposure vulnerability in the WordPress Login \u0026 Register Forms plugin (easy-login-woocommerce) allows remote email enumeration when configured in verification-code mode.","title":"Login \u0026 Register Forms: Unauthenticated email enumeration (CVE-2026-18470)","url":"https://feed.craftedsignal.io/briefs/2026-11-cve-2026-18470/"}],"language":"en","title":"CraftedSignal Threat Feed - Login \u0026 Register Forms (Easy-Login-Woocommerce) (\u003c 4.0.2)","version":"https://jsonfeed.org/version/1.1"}