Login & Register Forms < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response

Description

The plugin does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.

This requires the non-default verification-code reset mode to be enabled; the shipped default is unaffected. The redaction preserves the length and structure of every part of the address, and the same request will confirm whether a complete candidate address is registered, so a redacted address can be reconstructed and verified. Where an account's username is itself email-shaped, the stored address is returned with no redaction at all.