Unauthenticated Email Disclosure in Login & Register Forms WordPress Plugin

Executive Summary

This vulnerability affects the Login & Register Forms WordPress plugin before version 4.0.2. It allows unauthenticated users to obtain registered users' email addresses, including administrators', by exploiting improper password reset request handling and insufficient email address redaction in responses.

Useful 0 Not Useful 0

Detection Guidance

Check if the Login & Register Forms WordPress plugin version is below 4.0.2. Look for unauthenticated password reset requests that expose email addresses in responses. Test by submitting a password reset request and inspecting the response for unredacted or partially redacted email addresses.

Useful 0 Not Useful 0

Impact Analysis

Attackers could harvest email addresses to launch phishing attacks, spam campaigns, or targeted social engineering attempts. If an attacker knows a username resembling an email, they may retrieve the full unredacted address, increasing risk of account compromise or identity theft.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR by exposing personal data (email addresses) without consent. Organizations could face fines for failing to protect user data adequately. HIPAA compliance may also be impacted if email addresses of healthcare-related users are exposed.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Login & Register Forms plugin to version 4.0.2 or later immediately. Disable the non-default verification-code reset mode if enabled. Review server logs for suspicious password reset requests. Consider temporarily disabling the plugin until updated if urgent.

Useful 0 Not Useful 0