CVE-2025-15001
Published: 06 January 2026
Summary
CVE-2025-15001 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Wordpress (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).
Deeper analysis
CVE-2025-15001 is a privilege escalation vulnerability via account takeover in the FS Registration Password plugin for WordPress, affecting all versions up to and including 1.0.1. The issue arises because the plugin does not properly validate a user's identity prior to updating their password, as detailed in CWE-639 (Authorization Bypass Through User-Controlled Key). Published on 2026-01-06, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no user interaction required. By leveraging the flawed password update mechanism, they can change the passwords of arbitrary users, including administrators, and subsequently gain full access to those compromised accounts for further malicious actions.
Advisories point to mitigation through updating the plugin beyond version 1.0.1. Key resources include the vulnerable source code in WP/Auth.php at https://plugins.trac.wordpress.org/browser/registration-password/tags/1.0.1/src/WP/Auth.php, the patch applied in changeset 3431651 at https://plugins.trac.wordpress.org/changeset/3431651/registration-password, and Wordfence's threat intelligence details at https://www.wordfence.com/threat-intel/vulnerabilities/id/22351b90-fc34-44ce-9241-4a0f01eb7b1c?source=cve.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1074
Vulnerability details
The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This is due to the plugin not properly validating a user's identity prior to updating their password.…
more
This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote exploitation of a public-facing WordPress plugin vulnerability enables account takeover via improper password validation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires users to authenticate prior to changing authenticators, directly preventing the plugin's unauthorized password updates due to lack of identity validation.
Mandates proper management of accounts and passwords, including controls over modifications to thwart unauthenticated account takeovers.
Enforces approved authorizations for logical access to resources like password update functions, blocking the authorization bypass vulnerability.