CVE-2026-14836

unknowncovered by 1 sourcefirst seen 2026-08-01

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

⚡ Watch CVE-2026-14836

Get an email if CVE-2026-14836 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Advisory coverage (1)

unknownCVE-2026-14836: The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate li…nvd · 2026-08-01

External references

NVD record for CVE-2026-14836

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-14836 status](https://www.csirts.com/badge/CVE-2026-14836)](https://www.csirts.com/cve/CVE-2026-14836)