CVE-2025-47646
Published: 23 May 2025
Summary
CVE-2025-47646 is a critical-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 8.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-47646 is a weak password recovery mechanism for forgotten passwords, classified as CWE-640, in the PSW Front-end Login & Registration WordPress plugin. It affects all versions from n/a through 1.13 and received a CVSS 3.1 score of 9.8 reflecting unauthenticated network access with high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the flawed recovery flow to reset or hijack arbitrary user passwords, leading to full account takeover on sites using the plugin.
The single referenced advisory from Patchstack identifies the issue as a broken authentication vulnerability in version 1.12 and earlier.
EPSS rose from lower values to a peak of 0.1263 on 2026-02-06 before receding to the current 0.0721, indicating post-disclosure exploitation interest that warrants renewed attention.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28110
Vulnerability details
Weak Password Recovery Mechanism for Forgotten Password vulnerability in Gilblas Ngunte Possi PSW Front-end Login & Registration psw-login-and-registration allows Password Recovery Exploitation.This issue affects PSW Front-end Login & Registration: from n/a through <= 1.13.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.