CWE-640
Weak Password Recovery Mechanism for Forgotten Password
The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
We have discovered 219,589 live websites that are affected by CWE-640.
CVEs
- Count - 22
CWE References
Website Distribution by Country
Number of websites using CWE-640 United States | 54,829 websites |
 Germany | 18,825 websites |
 France | 12,285 websites |
 Brazil | 9,324 websites |
 Italy | 8,899 websites |
 Spain | 8,704 websites |
 GB | 8,241 websites |
 Netherlands | 5,944 websites |
 India | 5,928 websites |
 Poland | 5,729 websites |
Website Distribution by TLD
Number of websites using CWE-640| .com | 88,781 websites |
| .org | 10,326 websites |
| .de | 9,658 websites |
| .com.br | 8,410 websites |
| .it | 6,215 websites |
| .ru | 5,009 websites |
| .fr | 4,994 websites |
| .nl | 4,968 websites |
| .pl | 4,240 websites |
| .co.uk | 4,094 websites |
Newest CVEs
List of the most recent CVEs that are part of CWE-640| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Aug, 2026 | CVE-2026-19632 | TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure | 40,062 |
| Aug, 2026 | CVE-2026-77264 | Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure | 14 |
| Aug, 2026 | CVE-2026-12949 | Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter | 1,234 |
| Aug, 2026 | CVE-2026-61967 | WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability | 303 |
| Aug, 2026 | CVE-2026-14364 | TrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'tbab-userid' | 52 |
| Aug, 2026 | CVE-2026-9273 | Membership Plugin – Kadence Memberships <= 4.0.0 - Unauthenticated Password Reset Link Poisoning to Account Takeover | 217 |
| Jul, 2026 | CVE-2026-15155 | Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection | 168,234 |
| Jul, 2026 | CVE-2026-7655 | SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook | 2,637 |
| Jun, 2026 | CVE-2026-11551 | Branda – White Label & Branding, Free Login Page Customizer <= 3.4.29 - Unauthenticated Privilege Escalation via Account Takeover | 133 |
| May, 2026 | CVE-2026-7459 | Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction Endpoint | 1 |
The most widespread CVEs
List of the most common CVEs that are part of CWE-640| Discovered | CVE | Description | Websites |
|---|---|---|---|
| Jul, 2026 | CVE-2026-15155 | Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection | 168,234 |
| Aug, 2026 | CVE-2026-19632 | TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure | 40,062 |
| Dec, 2025 | CVE-2025-14783 | Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect | 5,560 |
| Jul, 2026 | CVE-2026-7655 | SureCart <= 4.2.3 - Unauthenticated Linked WordPress Account Takeover via Forged customer.updated Webhook | 2,637 |
| May, 2026 | CVE-2026-7652 | LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism | 2,392 |
| Aug, 2026 | CVE-2026-12949 | Wishlist Member X <= 3.34.1 - Unauthenticated Account Takeover via 'mergewith' Parameter | 1,234 |
| Jan, 2022 | CVE-2022-22691 | Umbraco Password Reset URL Poison | 587 |
| Aug, 2026 | CVE-2026-61967 | WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability | 303 |
| Aug, 2021 | CVE-2021-37693 | Re-use of email tokens in Discourse | 277 |
| Feb, 2025 | CVE-2025-1570 | Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.1 - Privilege Escalation and Account Takeover via Weak OTP | 271 |
Websites affected by CWE-640
Top websites that are affected by CWE-640. Please click on the "Contact us" link to get more information.| Domain | Country | Rank | Contacts |
|---|---|---|---|
| ***************.eu | Netherlands | *,*** | |
| **************.com |  Canada | *,*** | |
| **********.com | United States | *,*** | |
| ******.com | United States | *,*** | |
| *********.com | United States | *,*** | |
| ******.com | United States | *,*** | |
| *********.com | United States | *,*** | |
| ********.com | United States | *,*** | |
| ******.*********.com | United States | *,*** | |
| *************.com | United States | *,*** |