Cyber Posture

CVE-2025-14996

Critical

Published: 06 January 2026

Published
06 January 2026
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 40.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior…

more

to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match
prevent

Enforces approved authorizations preventing unauthenticated attackers from updating arbitrary user passwords without identity validation.

IA-5 Authenticator Management good match
prevent

Requires verification of user identity prior to authenticator changes, directly mitigating the plugin's failure to validate identity before password updates.

AC-2 Account Management good match
prevent

Establishes secure procedures for managing accounts and passwords, restricting unauthorized changes to privileged accounts like administrators.

Security SummaryAI

CVE-2025-14996 is a privilege escalation vulnerability via account takeover in the AS Password Field In Default Registration Form plugin for WordPress, affecting all versions up to and including 2.0.0. The issue stems from the plugin failing to properly validate a user's identity before updating their password, published on 2026-01-06 with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-639 (Authorization Bypass Through User-Controlled Key).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed password update mechanism, they can change the passwords of arbitrary users, including administrators, to gain unauthorized access to those accounts and potentially achieve full site compromise.

Advisories and related resources, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/061f022b-b922-4499-bb34-8ea91ba5ace3?source=cve and the plugin source code at https://plugins.trac.wordpress.org/browser/as-password-field-in-default-registration-form/tags/2.0.0/as-password-field-default-registration.php, provide further details on the vulnerability for mitigation guidance.

Details

CWE(s)
CWE-639

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Unauthenticated remote exploitation of a public-facing WordPress plugin vulnerability (T1190: Exploit Public-Facing Application) enables arbitrary account takeover, including administrators, resulting in privilege escalation (T1068: Exploitation for Privilege Escalation).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References