CyberRota Analysis
AI-GeneratedThe Login & Register Forms plugin for WordPress versions prior to 4.0.2 is vulnerable due to its failure to enforce password reset attempt limits based on server-side values, relying instead on client-controlled data. This flaw allows unauthenticated attackers to reset the attempt limit and brute-force verification codes, potentially leading to account takeovers, including those of administrators. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Login & Register Forms WordPress plugin before 4.0.2 does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.