Privilege Escalation in PSW Front-end Login & Registration Plugin for WordPress

CVE-2025-4607

What is CVE-2025-4607?

The PSW Front-end Login & Registration plugin for WordPress contains a vulnerability that allows attackers to exploit a weak One-Time Password (OTP) mechanism in the password reset functionality. This vulnerability enables unauthenticated individuals to initiate password resets for any user, including those with administrative privileges. As a result, attackers can elevate their permissions, potentially leading to a complete takeover of the site. It is crucial for site administrators using this plugin to take immediate action to mitigate this risk.

References