CVE-2026-18468 is an improper authentication vulnerability (CWE-287) in the Login & Register Forms WordPress plugin versions before 4.0.2. The flaw arises because the plugin fails to bind the password reset verification state to the targeted account or the verifying party, instead using a client-controlled value. This weakness enables unauthenticated attackers to hijack accounts of users who have recently completed password reset verification, potentially including administrators. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required for exploitation. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

Successful exploitation allows unauthenticated attackers to take over any user account that has recently completed a password reset verification process, including administrator accounts. This results in full compromise of the affected accounts, leading to potential loss of confidentiality, integrity, and availability of the WordPress site managed by the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the password reset functionality and monitor for suspicious activity related to password resets. Avoid using affected versions in production environments.