CVE-2025-15001
Published: 06 January 2026
Description
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password.…
more
This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Mitigating Controls (NIST 800-53 r5)AI
Requires users to authenticate prior to changing authenticators, directly preventing the plugin's unauthorized password updates due to lack of identity validation.
Mandates proper management of accounts and passwords, including controls over modifications to thwart unauthenticated account takeovers.
Enforces approved authorizations for logical access to resources like password update functions, blocking the authorization bypass vulnerability.
Security SummaryAI
CVE-2025-15001 is a privilege escalation vulnerability via account takeover in the FS Registration Password plugin for WordPress, affecting all versions up to and including 1.0.1. The issue arises because the plugin does not properly validate a user's identity prior to updating their password, as detailed in CWE-639 (Authorization Bypass Through User-Controlled Key). Published on 2026-01-06, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed password update mechanism, they can change the passwords of arbitrary users, including administrators, and subsequently gain full access to those compromised accounts for further malicious actions.
Advisories point to mitigation through updating the plugin beyond version 1.0.1. Key resources include the vulnerable source code in WP/Auth.php at https://plugins.trac.wordpress.org/browser/registration-password/tags/1.0.1/src/WP/Auth.php, the patch applied in changeset 3431651 at https://plugins.trac.wordpress.org/changeset/3431651/registration-password, and Wordfence's threat intelligence details at https://www.wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1c?source=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing WordPress plugin vulnerability enables account takeover via improper password validation.