#3,356 Global Rank

20+ active installs

4/5 3 ratings

Since 2024 3 years active

Vulnerabilities

2 Total

2 Patched

0 Active

100% Resolved rate

Frontend Login and Registration Blocks <= 1.1.1 - Unauthenticated Privilege Escalation via Account Takeover

CWE-639 · Authorization Bypass Through User-Controlled Key

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.1.1. This is due to the plugin not properly validating a user's identity prior to updating their details like email via the flr_blocks_user_settings_handle_ajax_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

9.8 Critical Affected All – 1.1.1 Patched in ✓ 1.2.0 Published 8 May 2025 CVE CVE-2025-3605

Frontend Login and Registration Blocks <= 1.0.8 - Authenticated (Subscriber+) Privilege Escalation via Password Reset

CWE-620 · Unverified Password Change

The Frontend Login and Registration Blocks plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.8. This is due to the plugin not properly validating a user's identity prior to updating a password. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

8.8 High Affected All – 1.0.8 Patched in ✓ 1.0.9 Published 23 Apr 2025 CVE CVE-2025-3607

About Login, Registration and Lost Password Blocks

Login, Registration and Lost Password Blocks plugin provides blocks helps you to add login, register, lost password forms from front end.

Additionally, you can create user settings page, add limit login attempts and user activation functionality and more to your website…

Why Choose Frontend Login and Registration Forms

1. Easy to Use
You can add login, register, lost password or user settings with just a one click. They are all blocks!

2. Customization
Each block has color, font and size option in the right sidebar of block editor. You can easily customize your forms.

☑ Login Form Block
☑ Register Form Block
☑ Lost Password Form Block
☑ User Settings Form Block
☑ User Activation Form Block
☑ Welcome Card Block
☑ Menu Item Block (Login/Logout)
☑ Limit Login Attempts
☑ Limit Reset Request Attempts
☑ E-Mail Settings
☑ Strength Password
☑ Username Validation
☑ Customizable Form Fields
☑ Customizable Colors

Note: Please read the guide before using the plugin.

☑ Documentation
☑ Official Web Site

Compatibility

Block Editor
Site Editor

Ratings & Reviews

★★★★☆

3 ratings

5★

4★

3★

2★

1★

Recent Reviews

Loading reviews…

Changelog

1.2.3

Tested: Compatibility with WordPress 7.0

1.2.2

Fixed: Missing stable tag issue in readme.txt

1.2.1

Tested: Compatibility with WordPress 6.9

1.2.0

Fixed security issues reported from Plugin Check plugin
Enhanced security for Register Form Block
Enhanced security for Lost Password Form Block
Enhanced security for User Settings Form Block
Enhanced security for User Activation Form Block
Enhanced security for Login Form Block
Added new settings to Admin Settings Page
Added Password Strength Meter
Added Username Validation
Revised code for better performance
class-flr-blocks-i18n.php removed (load_plugin_textdomain() has been discouraged error)
Thanks to Verdure WordPress for the contribution

1.1.1

Add xhrFields ( withCredentials: true) to ajax requests

1.1.0

Translation files updated
Script translation support added

1.0.9

Fixed security issues reported from Plugin Check plugin
Checked compatibility with WordPress 6.8
Plugin name changed to “Login, Registration and Lost Password Blocks” from “Frontend Login and Registration Blocks”