Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force

Description

The plugin does not enforce its password reset attempt limit against a server-derived value, keying both the verification code and the per-source attempt counter on client-controlled data, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

This is a residual of the issue previously addressed in 3.2.5. That change moved the attacker-controlled value to a different client-supplied channel rather than removing the dependency on one, so the attempt limit remains bypassable in every release from 3.2.5 onwards.