CVE-2026-18470: Email Enumeration in Login & Register Forms

CVE-2026-18470 is an email enumeration vulnerability affecting WordPress plugin 'Login & Register Forms' in versions before 4.0.2. The flaw allows unauthenticated users to obtain email addresses of registered users, including administrators, by exploiting the password reset mechanism that fails to verify request ownership and inadequately redacts sensitive information in responses.

The assigned CVSS score is 7.5, classified as HIGH. The vulnerability was published by NVD on August 10, 2026. Public repositories on GitHub are reported to contain material related to the vulnerability, with recent activity. No public social media signals are available indicating mass exploitation.

For defenders: immediately update the 'Login & Register Forms' plugin to version 4.0.2 or later. Check access logs and password reset records for any enumeration attempts against your WordPress installation. If the plugin is no longer required, disabling or removing it is the safest option. Monitor your administrator email addresses for suspicious activity.