This vulnerability represents a CWE-307 (Improper Limitation of a Successful Login Retry) as well as a CWE-287 (Improper Authentication). The Login & Register Forms WordPress plugin before version 4.0.2 fails to enforce the password reset attempt limit correctly. The attempt counter and verification code rely on client‑controlled data, allowing an unauthenticated attacker to reset the counter and then brute‑force the reset code, gaining access to any user account, including administrators. This results in full account takeover.

Vendor: Unknown developer, product: Login & Register Forms WordPress plugin. Affected versions: all releases prior to 4.0.2. The vulnerability applies to any WordPress site that installs or uses this plugin without updating to a later version.

EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the flaw permits unauthenticated brute‑force of cryptographic verification codes, which can be achieved with a standard web request to the password‑reset endpoint. When the verification‑code reset mode is active, an attacker can reset the counter arbitrarily, making the brute‑force feasible. Because the attack requires only web‑based interaction and no privileged credentials, the risk is high for environments that rely on the default reset mechanism. The actual CVSS score is not provided; however, the impact is severe due to the potential for immediate administrator takeover.