CVE-2025-15001 CRITICAL

CVE-2025-15001: FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover

Vendor Fsylum
Product FS Registration Password
Weakness CWE-639 · IDOR
Published January 6, 2026
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Explanation of Vulnerability in Simple Terms

02Summary

FS Registration Password versions 1.0.1 and earlier contain a critical vulnerability that allows unauthenticated attackers to read sensitive data, modify site content, or disrupt service without any user interaction. The vulnerability stems from improper access control in the password registration mechanism. All users of this product should update immediately.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt service without authentication.

Potential impact on your site

04Site Impact

Attackers can access user data, alter site content, or take the site offline without needing valid credentials.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

January 6, 2026 CVE published
April 8, 2026 Record updated