PT-2026-6941 · WordPress · Jay Login & Register

Andrea Bocchetti · Publicado 2026-02-08 · Atualizado 2026-02-13 · CVE-2025-15027

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAY Login & Register plugin for WordPress versions prior to 2.6.04

Description The JAY Login & Register plugin for WordPress is susceptible to a privilege escalation issue. The plugin allows updating arbitrary user meta through the jay login register ajax create final user function, potentially enabling unauthenticated attackers to gain administrator privileges.

Recommendations Update the JAY Login & Register plugin to version 2.6.04 or later.

Correção

LPE

Improper Privilege Management

Enumeração de Fraquezas

CWE-269

Identificadores relacionados

CVE-2025-15027

Produtos afetados

Jay Login & Register

Referências · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-15027 · Nota de Segurança
• https://twitter.com/CveFindCom/status/2021240629838106671 · Publicação no Twitter
• https://twitter.com/transilienceai/status/2020339548551577912 · Publicação no Twitter
• https://twitter.com/PurpleOps_io/status/2020732234781667724 · Publicação no Twitter
• https://twitter.com/cracbot/status/2022264541711929406 · Publicação no Twitter
• https://wordfence.com/threat-intel/vulnerabilities/id/b08198a6-10e8-44ca-a1c5-8d987d85c469?source=cve · Nota
• https://twitter.com/CVEnew/status/2020356547948183835 · Publicação no Twitter
• https://t.me/cveNotify/151272 · Publicação no Telegram
• https://twitter.com/PurpleOps_io/status/2020732145858154572 · Publicação no Twitter
• https://t.me/CVEtracker/44072 · Publicação no Telegram
• https://twitter.com/TheHackerWire/status/2020321729802023274 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.5.01/includes/jay-login-register-ajax-handler.php#L788 · Nota