Potential Security Problem

Dear forum,
I am not sure the best place to report this but I think I have observed/encountered a security problem on a WordPress website where a user seems to be able to initiate a forgotten password request and then be able to intercept/spoof the key to change a users password and then login as that user. I have detailed logs/evidence but I don’t want to post the information here in case it that spreads knowledge of the issue.
I really need to be able to report this to WordPress experts to investigate.
How can I achieve this?
Rob