The Frontend Login and Registration Blocks plugin for WordPress allows an unauthenticated attacker to trigger an account takeover. The flaw arises because the flr_blocks_user_settings_handle_ajax_callback() function does not verify the caller’s identity before letting them change user data. An attacker can alter any user’s e‑mail address, including site administrators, and then reset the compromised password, gaining full control of the account. This constitutes a high‑severity privilege escalation flaw identified as CWE‑639.

The problem affects all versions of the arkenon Login, Registration and Lost Password Blocks plugin up to and including 1.1.1. WordPress sites that have this plugin installed and have not applied the latest fix are vulnerable.

The CVSS score of 9.8 indicates critical severity, and the EPSS score of 13% suggests a moderate likelihood that this vulnerability will be actively exploited. The flaw is not yet listed in the CISA KEV catalog. The exploit process is straightforward: an unauthenticated user sends a crafted AJAX request to the plugin’s endpoint to change the target user’s e‑mail address. No special privileges or additional software are required, making the attack path simple and likely to occur in the wild.