PT-2025-51072 · WordPress · Jay Login & Register

Kenneth Dunn · CVE-2025-14440 · Published 2025-12-13 · Updated 2025-12-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAY Login & Register plugin for WordPress versions prior to 2.4.01

Description The JAY Login & Register plugin for WordPress has a flaw in authentication. Incorrect authentication checking within the jay login register process switch back function, utilizing the jay login register process switch back cookie, allows attackers to bypass authentication. This enables unauthenticated attackers to log in as any existing user, including administrators, if they have access to the user id.

Recommendations Update the JAY Login & Register plugin to a version later than 2.4.01.

Fix

Weakness Enumeration

CWE-565

Related Identifiers

CVE-2025-14440

Affected Products

Jay Login & Register

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-14440 · Security Note
• https://twitter.com/SecAideInfo/status/2000873209130787018 · Twitter Post
• https://twitter.com/cracbot/status/2001608432189874365 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3418754 · Note
• https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.4.01/includes/jay-login-register-user-switching.php#L98 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/928877a6-eeeb-4ed5-900b-9b1560e1bf87?source=cve · Note
• https://twitter.com/0dayPublishing/status/1999704700933861879 · Twitter Post
• https://t.me/CVEtracker/39689 · Telegram Post
• https://twitter.com/MNovofastovsky/status/2001291759834337560 · Twitter Post
• https://twitter.com/offseq/status/1999752071172751642 · Twitter Post
• https://twitter.com/Nxploited/status/2001728586399793503 · Twitter Post
• https://twitter.com/CVEnew/status/1999865350620598672 · Twitter Post
• https://twitter.com/CveFindCom/status/1999882036228575269 · Twitter Post