Critical severity9.8NVD Advisory· Published Jan 6, 2026· Updated Apr 15, 2026

CVE-2025-15001

Description

The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Affected products

WordPress/Registration Passwordinferred
Range: <=1.0.1
Package: https://wordpress.org/plugins/registration-password

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

plugins.trac.wordpress.org/browser/registration-password/tags/1.0.1/src/WP/Auth.phpnvd
plugins.trac.wordpress.org/changeset/3431651/registration-passwordnvd
www.wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1cnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000