CVE-2026-14836 is a vulnerability in the Login & Register Forms WordPress plugin prior to version 3.2.5. The issue arises from improper authentication due to inadequate rate limiting on the password-reset verification-code mechanism. Both the verification code and the per-source attempt counter rely on an unauthenticated, client-controlled value, enabling attackers to reset the rate limit arbitrarily. This allows brute-force attacks on the verification code, leading to account takeover, including administrator accounts, when the verification-code reset mode is active. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated attacker can bypass rate limiting on the password-reset verification code by manipulating a client-controlled value. This enables brute-force attempts to guess the verification code and reset any user's password, including administrators, resulting in full account takeover. The vulnerability impacts confidentiality, integrity, and availability of affected accounts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the verification-code reset mode if possible or applying compensating controls to limit exposure. Monitor vendor channels for updates and apply patches promptly once released.