→ برگشت به فید آسیب‌پذیری‌ها CVE-2026-18470 · easy-login-woocommerce

آسیب‌پذیری امنیتی در افزونه Login & Register Customizer – Forms, Popup, Profile & WooCommerce

The Login & Register Forms plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.0.1. This is due to the lost-password code-flow response including the target account's email address (masked or unmasked) rather than returning a generic acknowledgement message. This makes it possible for unauthenticated attackers to enumerate registered user email addresses by submitting a lost-password request with the code recovery flow and reading the email address (or masked variant) returned in the server response.