Security note from MODX: The Forgot Manager Login plugin distributed with all versions of MODX Evolution (and 0.9.x) contains a vulnerability that allows users to gain unauthorized access to the MODX Manager.

Action:
Upgrade Forgot Manager Login to version 1.1.4 and also disabled the plug in.