PT-2026-1415 · WordPress · Fs Registration Password

Drew Webber · CVE-2025-15001 · Publicado 2026-01-06 · Atualizado 2026-01-09

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FS Registration Password plugin for WordPress versions prior to 1.0.2

Description The FS Registration Password plugin for WordPress is susceptible to privilege escalation, allowing account takeover. This occurs because the plugin does not correctly verify a user’s identity before allowing password updates. This flaw enables unauthenticated attackers to modify passwords for any user, including administrators, and subsequently gain unauthorized access to accounts.

Recommendations Update the FS Registration Password plugin to version 1.0.2 or later.

Correção

LPE

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2025-15001

Produtos afetados

Fs Registration Password

Referências · 9

• https://twitter.com/MNovofastovsky/status/2009745748129378553 · Publicação no Twitter
• https://t.me/CVEtracker/41480 · Publicação no Telegram
• https://wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1c?source=cve · Nota
• https://twitter.com/0dayPublishing/status/2008402116037967945 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2025-15001 · Nota de Segurança
• https://t.me/cveNotify/147802 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/registration-password/tags/1.0.1/src/WP/Auth.php · Nota
• https://twitter.com/CVEnew/status/2008408717092340040 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset/3431651/registration-password · Nota