PT-2026-1415 · WordPress · Fs Registration Password

Drew Webber · Published 2026-01-06 · Updated 2026-01-09 · CVE-2025-15001

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FS Registration Password plugin for WordPress versions prior to 1.0.2

Description The FS Registration Password plugin for WordPress is susceptible to privilege escalation, allowing account takeover. This occurs because the plugin does not correctly verify a user’s identity before allowing password updates. This flaw enables unauthenticated attackers to modify passwords for any user, including administrators, and subsequently gain unauthorized access to accounts.

Recommendations Update the FS Registration Password plugin to version 1.0.2 or later.

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-15001

Affected Products

Fs Registration Password

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-15001 · Security Note
• https://twitter.com/MNovofastovsky/status/2009745748129378553 · Twitter Post
• https://t.me/CVEtracker/41480 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1c?source=cve · Note
• https://twitter.com/0dayPublishing/status/2008402116037967945 · Twitter Post
• https://t.me/cveNotify/147802 · Telegram Post
• https://plugins.trac.wordpress.org/browser/registration-password/tags/1.0.1/src/WP/Auth.php · Note
• https://twitter.com/CVEnew/status/2008408717092340040 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3431651/registration-password · Note