The Frontend Login and Registration Blocks plugin for WordPress contains a flaw that prevents proper identity verification before a password change is performed. As a result, any authenticated user with Subscriber-level permission or higher can arbitrarily alter any other user's password, including that of administrators or other privileged accounts. This allows the attacker to assume the identity of a target account entirely, potentially leading to full system compromise.

WordPress sites running the arkenon Login, Registration and Lost Password Blocks plugin, with any version up to and including 1.0.8, are affected. The vulnerability is specific to the plugin’s lost‑password handling code and does not extend to other plugins or WordPress core.

The flaw carries a CVSS score of 8.8, indicating a high severity. Although the EPSS score is reported as <1%, meaning that exploitation bids are currently rare, the vulnerability remains open and has not been listed in CISA KEV. The attack vector is limited to authenticated users; an attacker must first obtain a valid user token with Subscriber or higher access. Once authenticated, the attacker can target any account’s password reset endpoint, making this a straightforward privilege escalation vector in any affected site. The impact is substantial: compromised administrator credentials can expose data, alter configurations, and facilitate further attacks.