Privilege Escalation in PSW Front-end Login & Registration Plugin for WordPress

CVE-2025-4607

What is CVE-2025-4607?

The PSW Front-end Login & Registration plugin for WordPress contains a vulnerability that allows attackers to exploit a weak One-Time Password (OTP) mechanism in the password reset functionality. This vulnerability enables unauthenticated individuals to initiate password resets for any user, including those with administrative privileges. As a result, attackers can elevate their permissions, potentially leading to a complete takeover of the site. It is crucial for site administrators using this plugin to take immediate action to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References