PT-2025-17718 · WordPress · Frontend Login/Registration Blocks

Kenneth Dunn · Published 2025-04-24 · Updated 2025-04-29 · CVE-2025-3607

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Frontend Login and Registration Blocks plugin for WordPress versions up to, and including, 1.0.7

Description The issue is related to privilege escalation via account takeover due to the plugin not properly validating a user's identity prior to updating a password. This allows authenticated attackers with Subscriber-level access and above to change arbitrary user's passwords, including administrators, and gain access to their account.

Recommendations For versions up to, and including, 1.0.7, update to a version that properly validates user identity before allowing password changes, or consider disabling the password update functionality for users with Subscriber-level access and above until a patch is available.

Fix

LPE

Weakness Enumeration

CWE-620

Related Identifiers

CVE-2025-3607

Affected Products

Frontend Login/Registration Blocks

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-3607 · Security Note
• https://twitter.com/VulmonFeeds/status/1915345756216586255 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3325911/#file35 · Note
• https://twitter.com/CveFindCom/status/1915330673818169701 · Twitter Post
• https://t.me/cvetracker/22277 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/b06ce1e4-5cfb-415d-ad09-db194d6b4354?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3325911/#file10 · Note
• https://twitter.com/vulns_space/status/1915344803287404900 · Twitter Post
• https://twitter.com/CVEnew/status/1915329392173056180 · Twitter Post
• https://twitter.com/cybercronai/status/1915503743098904817 · Twitter Post
• https://plugins.trac.wordpress.org/browser/frontend-login-and-registration-blocks/trunk/inc/class-flr-blocks-lost-password.php#L115 · Note
• https://t.me/cvedetector/23661 · Telegram Post
• https://twitter.com/cracbot/status/1917172085748531260 · Twitter Post
• https://twitter.com/cybercronai/status/1915421345954869734 · Twitter Post