CVE-2025-47646 CRITICAL

CVE-2025-47646: WordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability

Vendor Gilblas Ngunte Possi
Product PSW Front-end Login & Registration
Weakness CWE-640 · Weak password recovery
Published May 23, 2025
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.

Explanation of Vulnerability in Simple Terms

02Summary

PSW Front-end Login & Registration versions 1.13 and earlier contain a critical vulnerability allowing unauthenticated attackers to read sensitive data, modify site content, and disrupt service without user interaction. The vulnerability stems from improper access control in the authentication mechanism. All versions up to 1.13 are affected.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, and disrupt service without authentication.

Potential impact on your site

04Site Impact

Attackers can compromise user data, alter site content, and cause downtime without any warning or user action.

Conditions required to exploit

05Prerequisites

Network access only; no authentication or user interaction required.

Key dates

06Disclosure timeline

May 23, 2025 CVE published
April 29, 2026 Record updated