The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Easy Login Woocommerce Plugin | — | Update easy-login-woocommerce plugin to version 4.0.2, or a newer patched version | Oct 30, 2026 | Aug 5, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub