The Login & Register Forms WordPress plugin, for versions earlier than 3.2.5, fails to properly enforce the rate limit on the password-reset verification-code flow. The counter and the verification code are keyed to an unauthenticated, client-controlled value, allowing an attacker to reset the limit and brute-force the code. This results in possible compromise of any user account, including administrators, when the verification-code reset mode is enabled. The weakness is a CWE-287 authentication bypass vulnerability.

Any WordPress installation that uses the Login & Register Forms plugin in a version older than 3.2.5 is affected, regardless of vendor, as the fault resides in this plugin. Admin users are the most critical targets.

The EPSS score indicates a very low probability of exploitation in the wild. The attack requires unauthenticated access and the use of the plugin’s password-reset feature, but if carried out it grants full account takeover. The vulnerability has a CVSS score of 8.1, indicating high severity. The vulnerability is not listed in CISA KEV, and no official patch note is available in the data; an update to 3.2.5 or later is the only known mitigation.