Cyber Resilience

CVE-2025-15100

High

Published: 08 February 2026

Published
08 February 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0031 22.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2025-15100 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 22.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).

Deeper analysis

CVE-2025-15100 is a privilege escalation vulnerability in the JAY Login & Register plugin for WordPress, affecting all versions up to and including 2.6.03. The flaw arises from the 'jay_panel_ajax_update_profile' function, which permits updating arbitrary user meta. Published on 2026-02-08, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-269 (Improper Privilege Management).

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability remotely with low complexity and no user interaction required. Exploitation allows them to escalate their privileges to administrator level, enabling high-impact confidentiality, integrity, and availability compromises on the affected WordPress site.

Advisories from Wordfence (https://www.wordfence.com/threat-intel/vulnerabilities/id/fb900810-23a2-4920-a5e8-4388c4474de0?source=cve) detail the issue, while the plugin's source code at line 624 in https://plugins.trac.wordpress.org/browser/jay-login-register/tags/2.6.01/includes/user-panel/jay-login-register-ajax-handler-user-panel.php#L624 illustrates the vulnerable function. Security practitioners should review these for mitigation guidance, such as updating to a non-vulnerable version.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability details

The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin allowing a user to update arbitrary user meta through the 'jay_panel_ajax_update_profile' function. This…

more

makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

Direct privilege escalation vulnerability allowing authenticated users to modify arbitrary user meta and gain administrator rights via code flaw in the plugin.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-23896Shared CWE-269
CVE-2025-27639Shared CWE-269
CVE-2025-8899Shared CWE-269
CVE-2025-26705Shared CWE-269
CVE-2015-10139Shared CWE-269
CVE-2026-8972Shared CWE-269
CVE-2025-0893Shared CWE-269
CVE-2026-6769Shared CWE-269
CVE-2025-2858Shared CWE-269
CVE-2025-48613Shared CWE-269

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Requires timely identification, reporting, and correction of flaws like the improper arbitrary user meta update in the JAY plugin's AJAX function, directly preventing privilege escalation exploitation.

prevent

Enforces approved authorizations for access to system resources, preventing Subscriber-level users from updating user meta to escalate privileges via the vulnerable 'jay_panel_ajax_update_profile' function.

prevent

Limits privileges to the minimum necessary for users and processes, countering the CVE's improper privilege management that allows escalation to administrator from Subscriber access.

References