CVE-2025-14975: Privilege Escalation in Custom Login Page Customizer

The impact of CVE-2025-14975 is severe. An attacker exploiting this vulnerability can completely take over user accounts, including those with administrative privileges. This grants them full control over the WordPress site, enabling them to modify content, install malicious plugins, steal sensitive data, and potentially deface the website. The lack of authentication checks before password updates makes this vulnerability particularly dangerous, as it bypasses standard access controls. Successful exploitation could lead to significant data breaches and reputational damage.

1. Reserved2025-12-19
2. Published2026-01-08
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-14975 is to immediately upgrade the Custom Login Page Customizer plugin to version 2.5.4 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the plugin to prevent further exploitation. While a direct workaround is not available, implementing strong password policies and enabling multi-factor authentication (MFA) on administrator accounts can help reduce the impact of a successful account takeover. After upgrading, verify the fix by attempting to modify a user's password without proper authentication; the action should be denied.

Active installs

90KNiche

Plugin rating

4.8

Requires WordPress

4.0+

Compatible up to

6.9.4

Requires PHP

5.6+