CVE-2026-14836 is an improper authentication vulnerability (CWE-287) in the Login & Register Forms WordPress plugin prior to version 3.2.5. The issue arises because the plugin does not enforce rate limiting correctly on the password-reset verification-code process. Both the verification code and the per-source attempt counter rely on a client-controlled value that is unauthenticated, enabling attackers to reset the rate limit arbitrarily. This allows brute-force attempts on the verification code, leading to account takeover, including administrator accounts, if the verification-code reset mode is active.

An unauthenticated attacker can bypass rate limiting on the password reset verification code, enabling brute-force attacks to guess the code and take over user accounts, including those with administrative privileges. This compromises account integrity and potentially the entire WordPress site managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the verification-code reset mode if possible or applying additional protective controls to limit brute-force attempts on password reset functionality.