The PSW Front-end Login & Registration plugin for WordPress, in versions 1.12 and earlier, contains a weak, low‑entropy one‑time‑password mechanism implemented in the forget() function. An unauthenticated attacker can exploit this flaw to trigger a password reset for any user, including administrators. Once the password reset succeeds, the attacker obtains full administrative privileges, enabling complete site takeover. This constitutes a privilege escalation vulnerability rooted in CWE‑330, where insufficient entropy allows an attacker to predict the reset code.

Systems impacted are WordPress installations that employ the PSW Front-end Login & Registration plugin by EmpoweringProWebsite, any installation running a plugin version up to and including 1.12. Without a patch, every account on the site is vulnerable, regardless of role.

The vulnerability has a CVSS score of 9.8, reflecting its critical nature. The EPSS score of 1% indicates that the probability of exploitation in the wild is low, but still possible, especially if attackers target high‑value WordPress sites. The flaw is not listed in the CISA KEV catalog, which suggests no widespread exploitation has been formally documented yet. Attackers can leverage the publicly accessible password‑reset endpoint, with no authentication required, to carry out the exploit remotely. The combination of a low entropy OTP and the ability to trigger the reset for any user makes the attack efficient and difficult to defend against without a patch.