PSW – Login and registration, CVE-2025-4607
- CVE, Research URL
- Home page URL
- Application
- Published on
- May 31, 2025
- Research Description
- The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12 via the customer_registration() function. This is due to the use of a weak, low-entropy OTP mechanism in the forget() function. This makes it possible for unauthenticated attackers to initiate a password reset for any user, including administrators, and elevate their privileges for full site takeover.
- Affected versions
-
max 1.12.
- Status
-
vulnerable
| Previous vulnerability researches |
|---|
| PSW – Login and registration (CVE-2025-4607) , Jun 15, 2025 |
| PSW – Login and registration (CVE-2025-47646) , May 14, 2025 |