CVE-2025-14996

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jan 6, 2026
Last modified: Oct 7, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-149978.8The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path valid CVE-2025-149989.8The Branda plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.4.24. Thi CVE-2025-149994.3The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to m CVE-2025-15008.0IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another u CVE-2025-150004.4The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and incl CVE-2025-150019.8The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and incl CVE-2025-150029.8A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/m CVE-2025-150037.2A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipu CVE-2025-150048.8A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation o CVE-2025-150053.7A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the compo CVE-2025-150069.8A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/Check CVE-2025-150079.8A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform