CVE-2025-15100: Privilege Escalation in JAY Login & Register

This vulnerability allows an authenticated attacker, possessing only Subscriber-level access or higher, to escalate their privileges to that of an administrator. This grants the attacker complete control over the WordPress site, including the ability to install malicious plugins, modify content, and access sensitive data. The impact is significant, as it effectively compromises the entire WordPress installation. Successful exploitation could lead to data breaches, website defacement, and complete system takeover. The ease of exploitation, requiring only authenticated access, increases the likelihood of widespread attacks.

1. Reserved2025-12-25
2. Published2026-02-08
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the JAY Login & Register plugin to version 2.6.04 or later. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider temporarily restricting access to the 'jaypanelajaxupdateprofile' function. This can be achieved by modifying the plugin's code to implement stricter access controls or by using a WordPress security plugin to block access to the vulnerable endpoint. After upgrading, confirm the fix by attempting to escalate privileges with a Subscriber-level user account; the attempt should fail.

Active installs

60Niche

Plugin rating