Password Reset Brute Force in Login & Register Forms WordPress Plugin

Executive Summary

This vulnerability affects the Login & Register Forms WordPress plugin before version 3.2.5. It fails to properly enforce rate limits on password-reset verification codes by using a client-controlled value to track attempts. This allows attackers to bypass rate limits and brute-force the verification codes, potentially taking over any account including administrators if the verification-code reset mode is enabled.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Login & Register Forms WordPress plugin is running a version before 3.2.5. Inspect the plugin's password-reset flow for improper rate limiting enforcement. Look for repeated password reset attempts from the same source without blocking. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

If you use this WordPress plugin with version before 3.2.5, an attacker could exploit this to reset passwords and gain unauthorized access to any account on your site, including admin accounts. This could lead to data theft, site defacement, or further compromise of your WordPress installation.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to brute-force password reset codes, potentially gaining unauthorized access to user accounts. This could lead to unauthorized data access or modification, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Login & Register Forms WordPress plugin to version 3.2.5 or later to address the improper rate limit enforcement issue.

Useful 0 Not Useful 0