CVE-2026-18468

This CVE describes a password reset state machine vulnerability where the verification confirmation step keys on a client-controllable value, allowing an attacker to replay that value across sequential reset flows and hijack a legitimate user's verification to complete an account takeover they initiated. The CVSS 8.1 rating is misleading because it weights the outcome (full account takeover including admin accounts) while underweighting the preconditions—but the 'recently completed' qualifier that describes the constraint actually describes a near-constant condition on any WordPress site with regular user activity. The real question isn't whether the window exists, but whether an attacker can find someone in that window without requiring parallel access to their network session. The critical diagnostic question is what the 'client-controlled value' actually is in this plugin's implementation. Most password reset mechanisms bind verification state to a server-side token emailed to the user—this plugin appears to key confirmation on something the client can set or influence, breaking the binding between who initiated the reset and who confirms it. Check whether the plugin overrides WordPress core's reset functions rather than wrapping them, which would indicate it introduced a parallel insecure flow that bypasses WordPress's hardened token binding. Also audit for debug endpoints, cached verification pages, or logging that exposes this client-controlled value—fossil correctly notes that the fix in 4.0.2 may have closed the obvious path while leaving residual state or debug APIs that still expose the verification anchor. The exploitation path requires either active man-in-the-middle positioning during a victim's reset flow, or the ability to observe/infer the client-controlled value through network traffic, enumeration, or timing. On high-traffic sites this isn't a narrow window—it's practically continuous. Prioritize patching, but also treat this as evidence of a recurring pattern: authentication state confirmation keyed on client-controllable values has appeared in OAuth redirect binding, session fixation, and magic URL vulnerabilities across two decades of web security history. The pattern persists because developers inherit insecure mental models rather than secure reference implementations.

Reviewed through automated stages and approved by a human before publication.