CVE-2025-15001: 
WordPress vulnerability analysis and mitigation

CVE-2025-15001 is a privilege escalation via account takeover vulnerability in the FS Registration Password plugin for WordPress. The flaw affects all versions up to and including 1.0.1 and allows unauthenticated attackers to change arbitrary users' passwords — including administrator accounts — and gain full access to those accounts. The CVE was published on January 6, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 9.8 (Critical) (Wordfence).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key): the plugin's password update functionality in src/WP/Auth.php fails to properly validate the requesting user's identity before applying the password change, allowing any unauthenticated party to supply an arbitrary user identifier and reset that account's password. The attack vector is network-accessible, requires no privileges or user interaction, and has low attack complexity. Source code for the vulnerable version is publicly browsable, and a changeset patch has been committed to the WordPress plugin repository (Wordfence, WordPress Trac - Auth.php, WordPress Trac - Changeset).

Successful exploitation allows an unauthenticated attacker to reset the password of any WordPress user, including site administrators, and immediately log in with the new credentials. This results in complete compromise of the WordPress installation — full confidentiality, integrity, and availability impact — enabling the attacker to exfiltrate sensitive data, modify or delete site content, install malicious plugins or backdoors, and potentially pivot to the underlying server or connected systems (Wordfence).

1. Reconnaissance: Identify WordPress sites using the FS Registration Password plugin (version ≤ 1.0.1) via passive scanning, Shodan/Censys queries for WordPress installations, or by checking publicly accessible plugin metadata at /wp-content/plugins/registration-password/.
2. Identify target account: Enumerate valid WordPress usernames via the REST API (/wp-json/wp/v2/users), login error messages, or other WordPress username disclosure vectors. Target the administrator account for maximum impact.
3. Craft malicious password reset request: Send an unauthenticated HTTP request to the plugin's password update endpoint, supplying the target user's identifier (e.g., user ID or username) as a user-controlled key in the request parameters, without providing any valid authentication token or nonce.
4. Set new password: The plugin processes the request without validating the caller's identity, updating the target account's password to the attacker-supplied value.
5. Log in as target user: Use the newly set credentials to authenticate to the WordPress admin panel (/wp-admin/) and achieve full administrative access to the site (Wordfence, WordPress Trac - Auth.php).

• Network: Unexpected unauthenticated POST requests to the plugin's password update endpoint; unusual login activity from unfamiliar IP addresses immediately following password change events.
• Logs: WordPress authentication logs (wp-login.php) showing successful logins from new or foreign IP addresses for administrator accounts; entries in the WordPress database (wp_usermeta, wp_users) reflecting unexpected password hash changes.
• File System: Newly installed plugins, themes, or PHP webshells in wp-content/ directories following unauthorized admin access; modified wp-config.php or .htaccess files.
• Process/Behavior: Unexpected admin-level actions in WordPress audit logs (e.g., new admin user creation, plugin installation, option changes) not attributable to known administrators.

A patch was committed to the WordPress plugin repository (changeset 3431651), and users should update the FS Registration Password plugin to a version beyond 1.0.1 as soon as a patched release is available. If an update is not yet available or cannot be applied immediately, the plugin should be deactivated and removed from the WordPress installation. Administrators should audit all user accounts — especially administrator accounts — for unauthorized password changes, reset credentials for any potentially compromised accounts, and review recent login activity for suspicious access (Wordfence, WordPress Trac - Changeset).

Wordfence, the CNA that assigned this CVE, published a threat intelligence entry and included the vulnerability in their weekly WordPress vulnerability report for January 5–11, 2026. The vulnerability received coverage from security aggregators including TheHackerWire (Mastodon and Bluesky), CVE feed services, and CISA's weekly vulnerability bulletin (SB26-012). Community reaction has been limited, consistent with the absence of a public PoC and no confirmed active exploitation (Wordfence Weekly Report, CISA Bulletin).