Description
The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Published: 2026-01-06
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthenticated privilege escalation via password change
Action: Immediate Patch
AI Analysis

Impact

The AS Password Field In Default Registration Form plugin for WordPress is vulnerable because it fails to verify a user's identity before allowing a password change. An attacker can therefore change the password of any user, including administrators, without authenticating. The vulnerability results in unauthorized access to user accounts and is classified as CWE‑639.

Affected Systems

This issue affects the Aksharsoft Solutions "AS Password Field In Default Registration Form" WordPress plugin, all releases up to and including version 2.0.0. WordPress sites that have any of these versions installed are at risk.

Risk and Exploitability

The CVSS score of 9.8 indicates a critical level of risk. The EPSS score of less than 1% suggests the probability of exploitation is low, but the high severity makes this a top priority for remediation. The likely attack vector is a web‑based POST request to the plugin’s password update endpoint, executed by an unauthenticated user.

Generated by OpenCVE AI on April 22, 2026 at 15:58 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to the latest plugin release that is at least version 2.0.1 or later; this version includes the guard against unauthorized password changes.
  • After upgrading, immediately reset all administrator account passwords to prevent any compromised credentials from allowing further access.
  • Disable or remove the plugin from any WordPress installations that are no longer required, and enable two‑factor authentication on all administrative accounts as an additional protective measure.

Generated by OpenCVE AI on April 22, 2026 at 15:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Jan 2026 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Jan 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress
Wordpress wordpress
Vendors & Products Wordpress
Wordpress wordpress

Tue, 06 Jan 2026 05:00:00 +0000

Type Values Removed Values Added
Description The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 2.0.0. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Title AS Password Field In Default Registration Form <= 2.0.0 - Unauthenticated Privilege Escalation via Account Takeover
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:33:37.050Z

Reserved: 2025-12-20T12:33:41.264Z

Link: CVE-2025-14996

cve-icon Vulnrichment

Updated: 2026-01-06T14:40:52.400Z

cve-icon NVD

Status : Deferred

Published: 2026-01-06T05:15:59.810

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-14996

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T16:00:12Z

Weaknesses