External risk intelligence

WordPress FS Registration Password Plugin Account Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-15001

The vulnerability affects a WordPress plugin, which is a component of a web application. WordPress sites and their associated registration/authentication endpoints are typically public-facing, making this surface commonly reachable from the internet in standard deployments.

Privilege Escalation

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the FS Registration Password plugin for WordPress that allows unauthenticated attackers to take over user accounts, including administrator accounts, by changing passwords. This could grant unauthorized access to your organization's WordPress sites.

Attackers can seize control of accounts.
Affects popular WordPress sites and user access.
Confirm relevance and assess exposure to WordPress sites.

Attack Path

How an attacker could exploit the issue

Attackers can gain unauthorized administrative access to a WordPress site by exploiting a flaw in the FS Registration Password plugin. This vulnerability allows unauthenticated individuals to reset the passwords of any user, including administrators, by bypassing identity checks. Once an administrator's password is changed, the attacker can then log in as that administrator to gain full control of the website.

No authentication required to initiate attack.
Password reset functionality is the trigger.
Leads to full administrative account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to change the password of any user, including administrators, on a WordPress site using the FS Registration Password plugin. This could lead to unauthorized access to user accounts and the data they contain.

User account access and data.
Unauthenticated attackers change passwords.
Complete account takeover.

Operational Fix

Recommended remediation, mitigation, and detection steps

System owners and application administrators responsible for WordPress deployments should prioritize investigating the FS Registration Password plugin. The immediate first step is to identify all WordPress instances utilizing this plugin, assess their exposure to external networks, and confirm if they host business-critical data or services. Once identified and assessed, engage the accountable owner to plan remediation, which may involve vendor coordination or applying available updates.

Own the issue: WordPress administrators and site owners.
Verify first: Plugin usage and external reachability.
Action: Coordinate plugin updates or vendor engagement.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FS Registration Password plugin?

It is an add-on for WordPress websites designed to manage or modify how users handle account registration and authentication processes. By integrating this plugin, site owners alter the default WordPress user verification flow, which is where this security flaw exists.

Why is CVE-2025-15001 considered a privilege escalation issue?

This vulnerability, classified as CWE-639 (Authorization Bypass Through User-Controlled Key), occurs because the plugin fails to verify if a user is authorized to perform a password change. It allows an attacker to manipulate account identity checks, effectively tricking the system into granting them control over any account, including administrative ones.

How does an attacker trigger this vulnerability?

An attacker initiates this by interacting with the plugin's password reset functionality. Crucially, the flaw is triggered without any legitimate authentication; the system erroneously processes the request to change a password without confirming the user's current identity. Normal user activity, such as navigating a site or logging in legitimately, does not trigger this bug.

Do I need to worry about this if my site is not public?

Halo Surface Signal indicates that because this plugin manages authentication endpoints, it is highly likely to be reachable from the internet in typical WordPress deployments. If your instance is not exposed externally, your risk is lower, but you should still assess whether the plugin is active and accessible within your network.

What should I do if I use this plugin?

Start by identifying every WordPress instance in your environment that has this specific plugin installed. Once you have a complete inventory, verify whether those sites are accessible to the public. If the plugin is present, prepare to update it or coordinate with your site administrators to remove the component until a secure version is available.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.